Email Bombing Attack: a Phishing Check

Reported by Jeff Rossen (Oct 16, 2026): a South Florida man woke up to find his inbox flooded with hundreds of spam emails — and while he was busy dealing with them, attackers used his bank's bill-pay to send $27,000 to an unknown American Express card. His bank denied his fraud claim twice, telling him the transaction came from a "known device."

This case is Rossen's reporting — it has not been independently verified by us. But the technique behind it is real and well documented by security researchers (see below).

1. The attacker already has a foothold. Stolen card details, a reused password, or partial account access — bought from a data breach or phished earlier.
2. They flood your inbox. Automated scripts submit your email address to hundreds of newsletter signup forms and website registrations in minutes. Each site sends back a welcome or confirmation email.
3. The real alert gets buried. Somewhere in that mountain of noise sits the one email that matters: your bank's fraud alert, a password-reset notice, or an order confirmation for a purchase you never made.
4. You miss it. You're deleting spam, maybe marking things as junk — and the bank's legitimate alert gets ignored, deleted, or swept into the spam folder with everything else.
5. The money moves. While you're distracted, the attacker completes the unauthorized transaction, changes account details, or moves into another compromised account.

This is called email bombing — also known as subscription bombing or list bombing.

• The flood looks legitimate. The emails come from real organizations — newsletters, charities, small businesses — whose signup forms were abused. They pass SPF, DKIM, and DMARC checks and land in your main inbox, not spam.
• The volume is staggering. Security firm Proofpoint reports subscription-bombing attacks can deliver over 1,500 emails per hour — enough to overwhelm any inbox in minutes.
• Alert fatigue does the rest. Faced with 600+ emails, most people bulk-delete. The bank's alert dies with the noise. In a case reported in September 2026, a victim received 600+ emails in 24 hours — and the bank's alert about a fraudulent $1,200 transaction was buried inside.
• There's often a second scam. Once the inbox is in chaos, a fraudster may call pretending to be tech support, offering to "clean up" the spam — for remote access to your computer or a fee.

1. Don't just delete — search first. Search your inbox for your bank's name plus alert, transaction, verification, password, and sign-in. Read anything from your bank before touching the spam.
2. Check your accounts directly. Open your bank's official app (not a link in any email) and review recent transactions, new payees, and scheduled payments.
3. Call the bank's fraud line. Use the number on the back of your card or the bank's official site — never a number from a suspicious email or an incoming "support" call.
4. Look for attacker-added controls. Check your email for new filters, rules, or forwarding addresses you didn't create — attackers add these to keep hiding future alerts.
5. Lock things down. Change your email and banking passwords (unique ones, via a password manager), sign out all sessions, and enable two-factor authentication everywhere it's offered.
6. Hang up on "helpers." If anyone calls offering to stop the spam for a fee or remote access, it's a second scam. Hang up.

• Separate email for banking. Use one address for financial accounts and a different one for shopping, newsletters, and signups. Attackers can't bomb an address they don't have.
• Alerts by SMS or push, not email alone. Transaction alerts that arrive as text or app push notifications can't be buried by an inbox flood.
• Unique passwords + 2FA. A password manager plus two-factor authentication on email and banking turns a partial foothold into a dead end.
• Know your bank's fraud number now — before you need it in a panic.

• The $27,000 victim case is Jeff Rossen's reporting (Oct 16, 2026) — we have not independently verified the victim's story or the bank's response.
• The technique itself is documented by security researchers (ACM, BlackCloak, Proofpoint) and multiple 2026 news reports — that part is solid.
• Not every email flood is an attack — some are harassment or pranks. But the safe move is to treat it as an alarm first and check your accounts.
• This page is general information, not financial or legal advice.