E-sign email

[Lmm72]

Anyone had problems receiving their e-sign email?  I received emails with device plan & agreement & one to say my order has gone through but that’s it. That was 2 days ago. 
been on chat & spoken to customer services & it’s still not resolved. I didn’t know there was even an e-sign document to sign until today & there was no mention of it when I ordered the device. Surely it should have come through as soon as I placed the order as it was supposed to be next day delivery. I already have two devices which I don’t think I will be renewing when the contracts are up & I’ve been with 3 10 years + without any bother until now

[Denis5]

Did happen with me only they saying wait for another 24h and its been 3 days now don't know who is works there but definitely they incompetent to do sort of work where is the management absolutely terrible service and its getting worst and worst 🤦‍♂️

[Jacann64]

Yes I am having problems and have been in the phone for 2 days the left hand don’t know what the right hand is doing.

I explained that if this does not go through I will need to go through credit checks again - thus impacting my credit file. The fact that they are aware of this surly they have a duty of care to alert new & existing customers of this giving the customer a choice.

[Joanne]

Having the same issue upgraded on Sunday had no e-sign documents through had to upgrade again today because of it had all documents apart from the e-sign it’s stressing me out 

[bnewton]

The error logs are as follows, this suggests that three.co.uk need to hire better technical staff 🙂

2023-09-05 11:52:04 H=cluster-j.mailcontrol.com [85.115.54.190]:60486 sender verify fail for <noreply@notification.three.co.uk>: cust7051-s.out.mailcontrol.com [85.115.60.190] : SMTP error from remote mail server after RCPT TO:<noreply@notification.three.co.uk>: 550 5.7.1 <noreply@notification.three.co.uk>... Relaying denied
2023-09-05 11:52:04 H=cluster-j.mailcontrol.com [85.115.54.190]:60486 X=TLS1.2:ECDHE-RSA-AES256-GCM-SHA384:256 CV=no F=<noreply@notification.three.co.uk> rejected RCPT <EMAIL REDACTED>: Sender verify failed

[bnewton]

Same exact problem here. It turns out that this is because three's technical support team is incompetent.

Let me dissect this issue for you...

Firstly, three send customers emails from multiple domains, which, is bad practice. In today's age, ideally, customers should be familiar with one or two solidly recognisable email addresses which they can easily identify as authentic. Once you introduce multiple subdomains and multiple emails, you muddy the situation and introduce security risks and vulnerabilities for your customers.

So, let's look at the email addresses which three use during the order checkout process:

@mails.three.co.uk
@servicemails.three.co.uk
@service.mails.three.co.uk
@notifications.three.co.uk

This is where it get's interesting. The first three emails work fine, they are set up correctly, they are secure, they have the appropriate authorisation and security protocols in place. Those emails are the accounts which send the 'order confirmation' and 'customer agreement form'. The reason you receive those emails but not the eSign one, is because those emails are sent from an email address that is properly configured on the server.

Unfortunately, problems arise when we investigate notifications.three.co.uk (which, it appears is the email address used to send the eSign form/link).

It turns out that notifications.three.co.uk domain DOES NOT have a DKIM or SPF record set up. This is awful news for three's customers, and introduces all kinds of vulnerabilities and security risks. Firstly, not having these records appropriately set-up, means that hackers can hijack, intercept or spoof emails to make them look like they were sent by three, when in fact they were not. The reason the eSign document is never received by customers, is because, it is sent from such a vulnerable email. Most email servers will rightfully reject this email without even putting it in the user's spam folder, it will simply be outright rejected and disappear into non-existence. This is because the recipient email server is unable to authenticate the authenticity of the sender.

I've tried to raise this issue multiple times, but, so far it's fallen on deaf ears. Nobody in their overseas call centre cares, nor do they understand English well enough to grasp how serious of a situation this is, and how urgently it should be addressed. This is a security risk.

[JohnD]

Hey @bnewton 

Thanks so much for taking the time to send this over and collate this info together. 

I wanted to advise that I've taken the above detail and passed it on to a couple of colleagues who'd be best suited to look into this. 

Thank you

John D

[SteveR]

Did you finally get your e sign sent to you if so how long did it eventually take?

[Lmm72]

No, still waiting

[adriaen]

I'm in the same boat, they are bullsh!tt!ng me and saying it's because there is a fault with Apple e-mail addresses (me.com & icloud.com etc.) - I've made a massive complaint as they are entirely incompetent.

I've placed the order 3 times now and still the same bs. Nobody takes responsibility or ownership and they hide behind 'process' and 'the system won't let me'.

Unfortunately for them, I work for a company that develops the cloud infrastructure call-centres use and I know for a fact, someone at Three can access the e-sign documents and send them to us manually, but they refuse to entertain that and say it can't be done because it's automated... Honestly, thy don't train their staff at all...

One guy said to me, 'I'll send you a text to the number ending XXXX to confirm DPA'...
I said 'To the number on the account I'm calling about that I can't sign for? Seriously?'

Unreal the piss-poor levels of service.

The end result today? 'The e-mail definitely come through today or tomorrow as you've now updated your account to a Hotmail.co.uk address'

Sure. Terrible service. Choose giffgaff, or buy through a 3rd party, these guys are horrible.

[SteveR]

I am in battle with three over this e sign, they won't release the phone iv ordered untill I have signed this however they have a problem which technical are trying to sort , been told that if I don't sign within 72 I have to apply again to purchase this phone then the cycle repeats it's self

My advise find another supplier as three seems to have lost the plot when it comes to back room technology, from what iv read this problem has been going on for a few weeks and to dat 15/06/23 they still don't have an answer, god help us when they finally merge with Vodafone