Learn what email bombing is, how criminals may use a flooded inbox to hide fraud, and what steps you can take to protect your accounts and personal information.
Email bombing—sometimes called an email bomb, subscription bomb, or list bomb—is when someone floods an email account with a huge number of messages in a short period. Often, the attacker uses automated systems to sign the victim up for newsletters, mailing lists, account notifications, or other legitimate services. 
The flood itself is disruptive, but there’s an important reason consumers should take it seriously! The attacker may be trying to hide a single important email among hundreds or thousands of unwanted messages. That hidden message could be a purchase confirmation, a password reset notice, a bank alert, an account change, or other evidence that an account has been compromised.
Stop. Search. Secure.
Email bombing, also called an email bomb, subscription bomb, or list bomb. This is when someone floods an email account with a huge number of messages in a short period. Often, the attacker uses automated systems to sign the victim up for newsletters, mailing lists, account notifications, or other legitimate services.
The flood itself is disruptive, but there’s an important reason consumers should take it seriously: the attacker may be trying to hide a single important email among hundreds or thousands of unwanted messages. That hidden message could be a purchase confirmation, a password reset notice, a bank alert, an account change, or other evidence that an account has been compromised.
Tips if you have been bombed:
- Don’t simply delete everything. Search the flood for messages about purchases, password changes, new accounts, money transfers, shipping, or changes to contact information.
- Check financial accounts directly. Open your bank and credit-card apps or type the institution’s website yourself rather than clicking links in the emails.
- Protect the email account first. Change the password if you suspect a compromise, use a unique password, and enable multifactor authentication.
- Look for security alerts. Check for unfamiliar logins, password resets, forwarding rules, filters, or changes to recovery email addresses and phone numbers.
- Check shopping and payment accounts. Review major retailers, PayPal/Venmo-type services, mobile carriers, and other accounts tied to the email address.
- Be careful with “unsubscribe.” During an attack, clicking unfamiliar unsubscribe links can lead to malicious websites or confirm that the address is active.
- ️ Use spam tools carefully. Once you’ve checked for important messages, mark unwanted mail as spam and use filters to regain control of the inbox.
- ☎️ Contact companies independently. If you discover an unauthorized transaction or account change, contact the company using its official app, website, statement, or the number on the back of your card—not information contained in a suspicious email.
- Document what happened. Screenshots and records of suspicious transactions, account changes, and the timing of the email flood can be useful if fraud occurred.
A suddenly flooded inbox may be more than spam. Someone may be creating noise to hide evidence of fraud. Find the important message before you start deleting.
Know the signs of email bombing, check for hidden fraud, and act quickly to protect your accounts and personal information.
Email bombing is a warning sign rather than just an annoyance. Stop. Search. Secure.
For more information, check out these links.
-
Federal Trade Commission – How to Recognize and Avoid Phishing Scams: Explains common phishing tactics, how to protect accounts, and what to do after clicking a suspicious link. Consumer Advice
FTC: How to Recognize and Avoid Phishing Scams -
FTC – Recovering a Hacked Email Account: Particularly useful after an email bombing incident. It covers checking forwarding rules, sent/deleted messages, account recovery, strong passwords, and two-factor authentication. Consumer Advice
FTC: How to Recover Your Hacked Email or Social Media Account -
IdentityTheft.gov: The federal government’s primary resource for reporting identity theft and creating a personalized recovery plan if the email flood is connected to fraudulent purchases or stolen personal information.
See all of our Extension Blogs here https://blogs.ifas.ufl.edu/monroeco/
0
