I started a comprehensive reply to this that seems to have disappeared into the ether. Here's a shorter summary in case it doesn't reappear.
Main warnings about what the security update seems to be driving at:
- On a web browser, logging in to the account is a special case, as logging in to this is now the route to the primary email (via a button once logged in). No direct web access to the primary email.
- Need to use unique third-party email addresses for the usernames of the account and any secondary emails.
- Usernames need to be in current domains. While the Blueyonder email addresses persist, we can't use them for new usernames. But they are still working for usernames until the update is enforced.
- Where a login changes to a new username, a new password is required, which is associated with the new username not the email address.
- Third-party app (IMAP) access (on the phone) then uses a separate code that I believe can only be requested via web access using the new username and password.
- With the VMO2 ID, getting to a consistent situation seems to involve a) using one unique third-party email address for the username of the VMO2 ID, the VM account and the O2 account, and b) then re-linking the two accounts to the VMO2 ID.
The order in which we do things seems to be critical in some cases.
I set a new username for my secondary Blueyonder email, which worked ok in isolation. Requested a third-party app code for IMAP access on the phone which also worked (and still does).
Called customer services who said use a third-party address for the account (and primary email), without making it crystal clear it had to be different from the one for the secondary email. That worked for the account but the secondary email lost web access. A second call to customer services made it clear they don't currently have a fix for this. But I then managed to sort out the VMO2 ID online as in the warnings above. Note the VMO2 ID log in also gives you the option to change the VMO2 ID username, by not using the one currently set (it doesn't explain this clearly).
Note to VM: please urgently establish a verified process for senior customer service agents, at customer request, to change a username and trigger a password reset, for the customer to implement without giving away their old or new passwords. Provide clear help online and during calls to enable customers to prep and execute this process. Allow for secondary email users not to be account holders by involving the latter as needed.
