Most of us treat unwanted emails, text messages, and phone calls as ordinary spam. Usually, that is exactly what they are. Sometimes, however, the volume and timing reveal something more deliberate.
Email bombing, SMS bombing, and phone call bombing are flooding attacks aimed at a person’s communication channels. Instead of taking a website offline, the attacker overwhelms an inbox or phone with messages and calls. The immediate effect is annoying, but disruption may not be the only objective.
The three source articles examine each type of bombing separately. What interested me most was the common idea connecting them: notification overload can be used to hide the one alert that actually matters.
Flooding a person instead of a server
In a traditional denial of service attack, an attacker sends more traffic to a system than it can reasonably process. Communication bombing applies a similar concept to an individual.
With email bombing, a target may suddenly receive hundreds or thousands of emails. These can include newsletter confirmations, account notifications, form submissions, or messages generated by automated tools.
SMS bombing floods a phone number with text messages. Depending on the method, the messages might be one time passwords, verification codes, promotional texts, or other automated notifications.
Call bombing repeatedly sends calls to the target. Automation and inexpensive internet calling services can make it possible to generate a large call volume. Caller ID spoofing can also make blocking individual numbers ineffective because the displayed number might not identify the real source.
These attacks do not always mean that the victim’s email account or phone has been compromised. An attacker may simply be abusing public forms, messaging gateways, authentication systems, or calling infrastructure. That distinction is important because changing an email password alone will not necessarily stop a flood created through unrelated third party services.
The dangerous message hidden in the noise
A flood may be simple harassment, but it can also serve as a distraction.
Imagine receiving several hundred subscription emails in a short period. Somewhere among them could be a legitimate warning from a bank, online store, cloud provider, or email service. It might report a purchase, password change, new login, money transfer, or account recovery attempt.
The attacker is counting on the victim to miss that message.
This is the part of communication bombing that deserves more attention. People naturally respond to notification overload by ignoring everything, deleting messages in bulk, or turning off alerts. Those reactions make sense, but they can also help conceal fraud.
The same principle applies to text messages. A sudden stream of verification codes may indicate that someone is repeatedly attempting to sign in, reset a password, or register the number with different services. It can also be caused by a simple mistake, such as another user entering the wrong phone number. Context and timing matter.
Repeated phone calls can create similar pressure. The victim may silence the phone completely and miss a real call from a bank, employer, delivery service, family member, or account security team.
In each case, the attack targets attention as much as technology.
What to check first
If I suddenly received a communication flood, my first priority would not be deleting everything. I would look for signs that the noise is covering a more serious event.
Useful searches in an email inbox include terms related to:
- Password changes and account recovery
- New login alerts
- Purchases, orders, and shipping confirmations
- Bank transfers and payment notifications
- Changes to account email addresses or phone numbers
- New devices and active sessions
- Multi factor authentication settings
- Mobile carrier account changes
Important accounts should be checked directly through their official applications or by manually entering their known website addresses. Links inside unexpected messages should not be trusted, even when the message looks urgent.
It is also worth reviewing financial activity, recent orders, email forwarding settings, recovery information, and active login sessions. If an email account is compromised, an attacker might create forwarding rules or filters that hide security messages even after the visible flood ends.
For SMS bombing, unexpected authentication codes deserve careful attention. They do not automatically prove that a password has been stolen, but they may show that someone is interacting with an account connected to the phone number.
A call flood presents another problem: the visible caller ID may be spoofed. Calling an unknown displayed number back may reach an unrelated person. The phone’s call history, timestamps, voicemails, and screenshots are more useful as evidence than assumptions about the number shown on screen.
Practical ways to reduce the disruption
Email providers already filter a large amount of abusive traffic, but a coordinated flood can still reach the inbox. Spam reporting, temporary filtering rules, and provider support can help control the volume.
Filters should be created carefully. A broad rule that deletes all messages containing words such as “order” or “security” could hide the exact alert the attacker wants the victim to miss. Sending suspected flood messages to a separate folder is safer than permanently deleting them during the incident.
Mass unsubscribing is also risky. Some unsubscribe links are legitimate, but malicious messages may use them to confirm that an address is active or to lead the recipient to a phishing page.
For SMS floods, built in spam protection from the phone and mobile carrier may reduce the volume. Blocking specific senders can help when the messages come from consistent numbers, although it is less effective when many services or rotating senders are involved. The mobile carrier may also have tools for reporting abusive texts.
With call bombing, features such as spam call detection, Do Not Disturb, and silencing unknown callers can provide temporary relief. Important contacts can be added to an allowed list so their calls still come through.
If the activity continues, documenting it is useful. Screenshots, timestamps, message samples, call logs, and support case numbers can help a service provider, carrier, employer, or law enforcement agency understand the pattern.
Account security still matters
Even when the flood does not originate from a compromised account, it is a good reason to review basic security.
Important accounts should use unique passwords stored in a reputable password manager. Reusing one password across multiple services makes credential stuffing attacks far more effective.
Multi factor authentication should also be enabled. An authenticator application, hardware security key, or passkey is generally safer than relying only on SMS. Text message authentication is still better than having no second factor, but phone numbers can be targeted through SIM swapping, number porting fraud, and interception attempts.
A mobile carrier account should have its own strong password and account PIN. If available, a port out lock or number transfer protection can make unauthorized transfers more difficult.
The email account deserves special protection because it is often the recovery channel for everything else. If an attacker controls the primary inbox, they may be able to reset passwords across many unrelated services.
Why these attacks are easy to underestimate
Communication bombing often looks unsophisticated. It does not necessarily involve malware, a software vulnerability, or direct access to the target’s device. In some cases, it is little more than automation combined with systems that do not adequately limit repeated requests.
That simplicity does not make it harmless.
The attack exploits ordinary human limitations. Nobody can carefully inspect thousands of messages while answering nonstop calls and verification texts. The attacker creates pressure, confusion, and fatigue, then hopes the victim overlooks something important.
There is also a broader security lesson for developers and service operators. Public forms, password reset pages, verification systems, and notification APIs need appropriate rate limits and abuse controls. Sending unlimited emails or texts after repeated unauthenticated requests can turn a legitimate service into part of someone else’s harassment campaign.
Controls such as request throttling, CAPTCHA challenges, device and network reputation checks, duplicate request detection, and sensible notification limits can reduce this abuse. At the same time, these defenses need to avoid locking legitimate users out during a real account recovery attempt.
Treat the flood as a possible incident
The main lesson I took from these articles is that an unexpected flood should be treated as a potential security incident, not just a spam problem.
The goal is to separate the signal from the noise. Reduce the disruption, preserve useful evidence, and check high value accounts through trusted channels. If fraudulent activity is discovered, contact the affected provider or financial institution immediately rather than responding through the suspicious message.
Email, SMS, and phone calls are still essential communication tools, but that also makes them attractive targets. Bombing attacks turn convenience into overload. Recognizing that pattern early can make the difference between dealing with an annoying flood and missing a much more serious account compromise.