Most people have dealt with ordinary spam. A few unwanted newsletters appear in an inbox, an unknown number calls, or a suspicious text claims that a package could not be delivered. It is irritating, but usually manageable.
Email subscription bombing, SMS bombing, and phone call flooding are different. These attacks create such a large volume of activity that the victim can no longer easily identify what is legitimate. Hundreds or thousands of messages may arrive from unrelated services, while calls repeatedly interrupt anything the person is trying to do.
The two articles by Wayne Hymenberg describe what these attacks can feel like from the victim’s perspective. One focuses on an inbox flooded with subscriptions, while the other covers repeated text messages and phone calls. What interested me most was not the volume itself. It was the idea that a flooding attack may be used as camouflage.
An attacker might not care whether the victim reads the spam. The real objective may be to bury one genuine password reset, transaction receipt, account change, or mobile number transfer notification.
That changes how the incident should be handled.
A denial of attention
In cybersecurity, a denial of service attack usually means overwhelming a system until legitimate users cannot access it. Flooding an inbox or phone applies a similar idea to a person.
The victim has limited time and attention. If hundreds of notifications arrive in a few minutes, reviewing every message becomes practically impossible. Important communication is still technically being delivered, but it becomes difficult to find and process.
I think of this as a denial of attention attack.
The attacker is not necessarily breaking the email server or disabling the mobile network. Instead, the attacker is making the communication channel unreliable from the victim’s point of view. The inbox still works, but the user cannot confidently separate a bank alert from a newsletter confirmation. The phone still receives calls, but answering each one is no longer realistic.
This is also why the psychological pressure matters. Constant ringing, vibration, and notifications create urgency. Urgency increases the chance that someone will click a phishing link, share a verification code, delete useful evidence, or overlook a real warning.
How legitimate services become part of the attack
Many messages in a subscription bomb do not come from an attacker’s own mail server. They may come from real stores, charities, newsletters, event platforms, and other organizations.
An automated tool can submit the victim’s email address or phone number to a large number of public forms. Each website then sends its normal confirmation or welcome message. From the website’s perspective, it may look like an ordinary registration.
This creates a filtering problem. Traditional spam detection is good at identifying known malicious domains, suspicious attachments, and repeated messages from one source. A subscription attack may instead produce different messages from many reputable senders. Those messages can pass SPF, DKIM, and DMARC checks because they genuinely came from the organizations shown in the sender fields.
The messages are legitimate at the transport level, but the requests that triggered them were unauthorized.
Phone flooding has a similar complication. Calls can come through multiple systems, and displayed numbers may be spoofed. Blocking one number at a time does not accomplish much if every call presents a different caller ID. It can also create collateral damage because the number shown on the screen may belong to an innocent person.
The source articles repeatedly mention a commercial flooding service by name. I do not think naming or promoting such a service adds useful defensive value. It may even direct more attention toward infrastructure designed for abuse. The important point is that these attacks can be automated and distributed across many forms, messaging systems, and calling services. Defenders do not need instructions for launching one to understand the risk.
The flood may be hiding an account takeover
A sudden wave of subscriptions does not automatically mean an email account has been compromised. In many cases, an attacker only needs to know the address. The same is true for SMS bombing. Receiving verification codes does not, by itself, prove that someone can read the victim’s messages or control the phone.
The surrounding activity is what matters.
Warning signs of a broader compromise include:
- Password resets for accounts the victim actually uses
- Logins from unfamiliar devices or locations
- Changes to recovery email addresses or phone numbers
- New forwarding rules or inbox filters
- Unknown purchases, transfers, or payment methods
- Changes to a shipping or billing address
- Unexpected SIM replacement or number transfer activity
- Sudden loss of mobile service
- Calls asking for passwords or verification codes
- Threats, extortion demands, or messages containing personal details
A criminal making an unauthorized purchase might trigger an email bomb at the same time. The receipt still arrives, but it becomes one message among hundreds of confirmations and newsletters. The criminal does not need to conceal it permanently. A short delay may be enough for an order to ship or a transfer to become more difficult to reverse.
This is why deleting everything is the wrong first move.
What to do during a flooding attack
The immediate goal is to reduce the disruption without destroying evidence or missing a genuine security alert.
First, silence the noise. Email notifications can be temporarily disabled, and a phone can be placed in Do Not Disturb or Focus mode. Trusted contacts should remain allowed if the device supports that option. It is usually better to let unknown calls go to voicemail than to answer every one.
Next, preserve a basic record of the incident. Take screenshots showing the volume, senders, call history, and timestamps. Record approximately when the flood began. Save unusual voicemails and threatening messages. There is no need to document every notification, but the evidence should show the pattern and scale.
Do not click links, reply to messages, or share verification codes. A malicious email or text may be deliberately mixed into the flood. Even if a message appears to come from a familiar company, open the official app or use a trusted bookmark instead.
Then check the most important accounts directly. A reasonable order is:
- Primary email account
- Bank, card, and payment accounts
- Mobile carrier account
- Password manager
- Cloud storage
- Shopping accounts with saved payment methods
- Social media and messaging accounts
- Work, health, tax, government, and domain accounts
Look for unfamiliar sessions, changed contact details, pending transactions, new payees, password resets, recovery requests, and unknown devices.
The email account deserves particular attention because it is commonly used to recover other accounts. Review forwarding settings, filters, delegated access, connected applications, app passwords, sent mail, deleted messages, and archived folders. A malicious rule that quietly deletes bank alerts can remain useful to an attacker long after the visible flood ends.
If there is any evidence of unauthorized access, change the password from a trusted device, use a unique password, revoke unknown sessions, and remove suspicious connected applications.
Search is more useful than scrolling
One of the most practical lessons from the email article is to search the mailbox instead of trying to read every message manually.
Useful search terms include:
- Password reset
- Security alert
- New login
- New device
- Verification code
- Purchase
- Receipt
- Payment
- Transfer
- Withdrawal
- Shipping address
- Recovery request
- Email changed
- Phone number changed
Searching for the names of banks, card providers, mobile carriers, cloud platforms, and major shopping accounts can also help. The inbox, spam folder, trash, archive, and any automatically created folders should all be checked.
Filters can make the inbox usable again, but they should be narrow. A rule that moves messages containing “confirm your subscription” is less risky than a broad rule that deletes everything containing “confirmation.” The second rule could hide a real order confirmation or security notice.
Moving suspected subscription messages into a temporary folder is safer than permanently deleting them. They can be reviewed once the urgent account checks are complete.
Why SMS authentication becomes a weak point
A text flood demonstrates one of the limitations of SMS based authentication. Even if an attacker cannot intercept the codes, the victim is forced to depend on a communication channel that has become chaotic.
There is also the separate risk of SIM swapping. If a criminal persuades a carrier to transfer the number to another SIM or account, texted security codes may be delivered to the criminal instead.
For important accounts, stronger authentication methods are preferable:
- Passkeys
- Hardware security keys
- Authenticator applications
- Trusted application approval prompts
- Recovery codes stored securely offline
SMS authentication is still better than relying on a password alone, but it should not be the first choice for sensitive accounts when stronger options are available.
The mobile carrier account should also have a unique password and a separate account PIN. If the carrier provides protections against SIM replacement or number porting, those controls are worth enabling.
Do not assume the device itself was hacked
A phone receiving hundreds of calls or messages can feel compromised, but flooding usually happens outside the device. External systems are sending traffic to the number.
A factory reset will not stop messages addressed to that same number. It may also erase evidence and create additional recovery work.
Device compromise should be investigated only when there are other indicators, such as unknown applications, unfamiliar device management profiles, disabled security settings, unexplained permission changes, or sessions that return after being revoked. Updating the operating system and applications is sensible, but panic resetting the phone is not a useful response to a basic flood.
The same reasoning applies to email. Subscription bombing proves that someone knows the address. It does not prove that they know the password. Evidence should guide the response.
Website owners share some responsibility
These attacks also expose weaknesses in public registration and subscription forms.
A website that accepts unlimited submissions without verification can become an unwilling participant in harassment. Each individual message may seem harmless, but thousands of vulnerable forms together create an effective flooding system.
Website operators can reduce abuse with:
- Double opt in confirmation
- Rate limiting by address, phone number, account, and network
- Bot detection and challenge mechanisms
- Limits on repeated verification messages
- Monitoring for unusual submission spikes
- Delayed or suppressed marketing until ownership is confirmed
- Abuse reporting channels
- Server logs that support incident investigation
Rate limiting needs to consider more than an IP address. Attackers can rotate addresses or use distributed infrastructure. Limits should also detect repeated submissions targeting the same recipient.
Companies should be careful not to create another problem while trying to stop automation. Accessibility, privacy, and false positives still matter. The goal is not to make every form frustrating. It is to prevent one person from generating thousands of messages without resistance.
Preparing before an attack happens
It is impossible to prevent someone from typing a known address or phone number into a public form. Preparation can still reduce the impact.
Using separate email addresses by purpose is a practical approach. A private address can be reserved for banking, government services, health portals, account recovery, and other sensitive uses. Another address can handle newsletters, shopping, forums, and public profiles.
The same principle can apply to phone numbers when a secondary number is practical. A publicly shared contact number should not automatically be the number protecting every financial and recovery account.
Important alerts should also use more than one channel. Banking applications can send push notifications for purchases, transfers, new payees, and profile changes. Depending entirely on email means an inbox flood can interfere with every warning at once.
It is also worth having a backup communication plan. Trusted contacts should know how to reach you if the main phone number becomes unusable. For a business, that might mean a backup line, customer portal, status page, or monitored email address.
The right response is investigation, not cleanup
The strongest lesson from both source articles is that the obvious problem can distract from the real one.
When an inbox, message app, or phone line is flooded, the natural impulse is to delete, block, and unsubscribe. Those actions may eventually help with cleanup, but they should come after checking for fraud and account compromise.
A better response is to slow down, preserve evidence, search for important alerts, and access critical accounts through trusted channels. The attack succeeds when the victim reacts to the noise without investigating why it appeared.
Email bombs, SMS floods, and call bombing are not always signs of a sophisticated breach. Sometimes they are simply harassment. Even so, the possibility that they are hiding an account takeover makes them worth treating as a security incident.
The flood is designed to capture attention. Good incident response starts by looking past it.