Email bombing: what it is and what to do
If your inbox suddenly fills with hundreds of sign-up confirmations and newsletters, someone has signed your address up to them on purpose. It is often a cover for something else.
Email bombing (or a subscription bomb) is when attackers flood your inbox with hundreds or thousands of emails, usually by signing your address up to many websites. The goal is often to bury an important email, such as a purchase, password change or bank alert. First check your important accounts for activity you didn't make, then change passwords, and be wary of anyone who calls offering to "fix" the flood.
Why attackers do it
- To hide something. A fraudulent order, a changed password or a new device sign-in sends you an alert. The flood buries it.
- To set up a fake support call. Attackers bomb a work inbox, then call or message pretending to be IT support, offering to fix it if you install remote-access software.
- Harassment. Sometimes it is simply meant to overwhelm you.
What to do first
- Check your bank, card, shopping and email accounts for orders, transfers or changes you didn't make.
- Search the flood for words like "order", "password", "receipt", "verification" or "sign-in".
- Change your email password and turn on 2-Step Verification or a passkey.
- Never let a caller "fix" it remotely. Your real IT team or email provider won't ask you to install remote-access tools out of the blue.
- At work, tell IT immediately.
How to stop the flood
- Don't click unsubscribe on hundreds of sites. Many are fake or confirm your address is active.
- Filter it: in Gmail, create a filter for words like "confirm your subscription" or "welcome to" that skips the inbox. See Gmail labels and filters and Outlook rules.
- Use Manage subscriptions in Gmail for real newsletters afterwards. See free ways to unsubscribe in bulk.
- Contact your email provider if the flood continues for days. Business accounts can ask IT to add temporary filtering.
Is email bombing dangerous?
The emails themselves are mostly harmless, but what they hide may not be. Treat a sudden flood as a warning sign that someone is targeting your accounts, and check them carefully. For phishing emails mixed into the flood, see how to report phishing.
Questions people ask
- Why am I suddenly getting so many emails?
- Someone has probably signed your address up to many websites at once. This is called email bombing, and it is often used to hide an alert about fraud on one of your accounts.
- How do I stop an email bomb?
- Check your accounts first, then use filters to move the flood out of your inbox. It usually slows down within a few days.
- Is email bombing illegal?
- It can be, depending on where you live and why it is done, especially when used for fraud or harassment. Report fraud to your bank and to the authorities.
- Should I unsubscribe from all the emails?
- No. Filter them instead. Clicking hundreds of unsubscribe links takes time and can confirm your address to spammers.