If you suddenly start receiving an endless stream of junk email, perhaps asking for confirmation of a subscription, you’re the victim of email bombing. The perpetrator is probably trying to hide their real goal, so here’s what to do.
What Is Email Bombing?
An email bombing is an attack on your inbox that involves sending massive amounts of messages to your address. Sometimes these messages are complete gibberish, but more often they’ll be confirmation emails for newsletters and subscriptions. In the latter case, the attacker uses a script to search the internet for forums and newsletters and then signs up for an account with your email address. Each will send you a confirmation email asking to confirm your address. This process repeats across as many unprotected sites as the script can find.
The term “email bombing” can also refer to flooding an email server with too many emails in an attempt to overwhelm the email server and bring it down, but that’s not the goal here—it would be challenging to bring down modern email accounts that use Google or Microsoft’s email servers, anyway. Instead of a denial-of-service (DOS) attack against the email servers you are using, the onslaught of messages is a distraction to hide the attacker’s true intentions.
Why Is This Happening to You?
An email bombing is often a distraction used to bury an important email in your inbox and hide it from you. For example, an attacker may have gained access to one of your accounts on an online shopping website like Amazon and ordered expensive products for itself. The email bombing floods your email inbox with irrelevant emails, burying the purchase and shipping confirmation emails so you won’t notice them.
If you own a domain, the attacker may be attempting to transfer it away. If an attacker gained access to your bank account or an account on another financial service, they might be trying to hide confirmation emails for financial transactions as well.
By flooding your inbox, the email bombing serves as a distraction from the real damage, burying any relevant emails about what’s going on in a mountain of useless emails. When they stop sending you wave after wave of email, it may be too late to undo the damage.
An email bombing may also be used to gain control of your email address. If you have a coveted address—something straightforward with few symbols and a real name, for instance—the entire point may be to frustrate you until you abandon the address. Once you give up the email address, the attacker can take it over and use it for their purposes.
What to Do When You Get Email Bombed
If you find yourself the victim of email bombing, the first thing to do is check and lock down your accounts. Log into any shopping accounts, like Amazon, and check for recent orders. If you see an order that you didn’t place, contact the shopping website’s customer support immediately.
You may want to take this a step further. On Amazon, it’s possible to “archive” orders and hide them from the normal order list. One Reddit user discovered an email from Amazon confirming an order for five graphics cards with a total value of $1000 buried in an onslaught of incoming email. When they went to cancel the order, they couldn’t find it. The attacker had archived the Amazon order, hoping that’d help it go undetected.
