She thought it was spam. It was actually a smokescreen to hide warnings from her bank — what to know about 'email bombing'

The woman hadn’t signed up for the newsletters, promotions and other messages that were suddenly clogging her inbox. And at first, it looked like nothing more than an especially aggressive burst of spam. But the flood of emails wasn’t random — it was a scam.

Cybersecurity experts call the tactic “email bombing,” or “subscription bombing,” and it’s designed to overwhelm your inbox while scammers hope you’ll miss an important fraud alert, password-reset notification or other warning hiding in the chaos.

How ‘email bombing’ works

The idea behind email bombing is straightforward: bury the important stuff under a mountain of other messages.

Scammers can use automated tools to sign an email address up for hundreds of websites, newsletters and online services in a short period of time. Suddenly, the inbox is filling up with welcome messages, subscription confirmations and other emails that may look perfectly legitimate.

That can make it much harder to spot the one message that actually matters.

In the case highlighted in The Washington Post, many of the emails came from real organizations, including newsletters, charities and small businesses. They weren’t necessarily the kind of obvious junk that would get caught by a spam filter, either, so they landed right in the woman’s inbox.

Buried among them was a legitimate fraud alert from her bank.

And while she’s sorting through hundreds of emails trying to figure out what’s going on, a scammer may have a window to make an unauthorized purchase, change account information or get into another account.

The volume can be staggering, too. Security firm Proofpoint says subscription-bombing attacks can deliver more than 1,500 emails an hour — enough to overwhelm an inbox within minutes and bury a critical security alert.

But the email flood may not be the end of the scam. Once the inbox is in chaos, a fraudster may reach out pretending to be a tech-support worker offering to help clean things up. The supposed solution can create a second problem, whether that’s handing over remote access to a computer or paying a fee for help that was never needed in the first place.

The warning signs to watch for

It’s easy to ignore a few random emails. But if hundreds suddenly start flooding your inbox, don’t assume it’s just a bad spam day. Before you start deleting them, check your bank and credit card accounts for purchases or other activities you don’t recognize.

It’s also worth searching the emails themselves. Look for words such as “fraud,” “order” or “password,” as well as the name of your bank or credit card company. An important alert may be buried in the mess.

And watch out for anyone who suddenly offers to “fix” the problem.

A scammer could use the chaos to send a phishing email or text, or call pretending to be from your bank or a tech-support company. Be especially wary if you’re told to click a link, call a number or give someone remote access to your computer.