Email Bombing Explained: Why Your Inbox Suddenly Floods

What is email bombing

Email bombing is when hundreds, sometimes thousands, of sign-up emails hit an inbox within hours. Newsletters, free trials, competitions, mailing lists: all real services, all legitimate, all triggered by bots signing your address up automatically. Because each service is genuine, the welcome emails usually sail straight past spam filters.

In one case reported in September, a woman in Virginia had her inbox swamped with hundreds of these messages over 24 hours. She hadn't signed up for any of it. The flood wasn't the point. It was cover. Buried somewhere in that mess was a genuine email from her bank, warning her about a fraudulent laptop purchase on her account.

Attackers get the email address itself from old data breaches, marketing databases, public leaks or earlier phishing attempts. Nothing more sophisticated than that is usually needed to start a bombing campaign.

What this actually means for you

Being email bombed does not automatically mean your account has been hacked. Often it just means your address exists somewhere it shouldn't, in a breach list or a database that got sold on. The bombing itself isn't usually the damage. It's a distraction technique.

There are two common reasons someone does this. First, to bury a genuine alert, an account sign-in notice, a password reset confirmation, a purchase invoice, somewhere you won't find it in time. Second, to set up a follow-up: a call or email from someone posing as "tech support", offering to fix your "email problem" for a fee, or talking you into installing remote access software. In a business setting, the same trick can be used to distract a security team while a bigger breach or a ransomware attack happens elsewhere.

What to do if it happens to you

Don't rush to unsubscribe from everything. It feels like the obvious first move, but it wastes time you need for something more important: finding out why this is happening.

Search before you delete. Go through your inbox and spam folder for anything that looks like a real security alert: a new sign-in, a password change you didn't make, a changed phone number or email on file, a purchase confirmation you don't recognise. If you find one, keep it. Don't delete it, don't archive it out of sight.

Check your sensitive accounts directly. Bank, PayPal, credit card, any crypto accounts, your Apple, Google or Microsoft account, and social media. Look for new devices logged in, changed passwords, altered recovery details or payment methods you didn't add.

If you find something suspicious: change that account's password to something strong and unique, turn on two-factor authentication, double-check the recovery email and phone number are actually yours, and contact the company directly through their official channels if you suspect fraud.

If you find nothing: that's a good sign. Once you're confident there's no underlying issue, clear the flood of sign-up emails. It's faster if you look for patterns, same sender domains, similar subject lines, a tight date range, and delete in batches rather than one by one.

Hang up on anyone offering to fix it. If you get a call or email from someone claiming to be tech support who can sort out your "email problem", that is the scam. Don't pay them. Don't let them install anything on your device. End the call.

Reducing the risk going forward

• Avoid putting your main email address on public-facing pages, social media bios, forums, anywhere it can be scraped.
• Use a password manager so every account has a strong, unique password. If one gets exposed in a breach, the rest stay safe.
• Turn on two-factor authentication wherever it's offered, ideally via an authenticator app or a passkey rather than SMS.
• Consider using a second email address for shopping, travel bookings and sign-ups you don't care much about, keeping your main address for banking, government and healthcare correspondence. If the throwaway address gets bombed, your important mail stays clean.

What this does not fix

A VPN does not stop email bombing. It encrypts your connection and hides your browsing from your network provider, but it has no effect on an address that's already sitting in a breach database somewhere. Nothing stops an email address being bought or scraped once it's out there; the only real defence is limiting exposure and reacting properly when it happens.

If you want to check whether a password you use has turned up in a known breach, Veystrix's free password checker at /tools/password does that in your browser without sending the password anywhere. And if a follow-up message or call does arrive claiming to offer a fix, run it past /tools/scam before you respond to it.