Change of username

[xorknight]

O2,

I was victim of fraud today, and they were able to change my username / email address. 

When someone updates their username or email address, could you ask them to provide their current password? 

And also what about offering a two factor authentication option? 

 

[MI5]

Personal details can't be changed without entering the OTP sent to your registered phone number.

Someone either has access to your phone or you gave them the code.

If you think you’ve been the victim of fraud – whether it’s because you’ve given details to someone over the phone, or clicked on a link in a suspicious text or email there are things you can do:
Contact your bank if you think you may have given out financial information. They can help protect your account and stop transactions.
Change your account and online account passwords. Not just your O2 account. All of them.
Forward fraudulent texts to O2 for free on 7726.
Contact Action Fraud on 0300 123 2040.
Call your Virgin Media or O2 customer services number if you think somebody’s taken out a contract using your details.
Virgin Media customers can phone 150 from their landline or 0345 454 1111 from any other phone.
O2 customers can call 202 from their O2 phone or 0344 809 0202 from any other phone.

[Enlli]

Did you respond to a request for a code sent by SMS?

They use the "Forgot Password" option. O2 send the code to your handset and that is used to get in. As long as no one gives the code they cannot do anything.