How to stop subscription bombing (email bombing)

To stop subscription bombing, first look for the one email the flood is hiding: a bank alert, an order confirmation or a password reset. Then secure that account, refuse any call from "IT support" about the spam, and make a filter that moves sign-up and welcome emails out of your Inbox. Unsubscribe and clean up only once the flood slows. With iCloud, Gmail or Outlook, Alrighty's Filters can move that kind of mail out as it arrives, and Stop mail and Clean up handle the senders after.

In a subscription bomb, also called email bombing or list bombing, a bot enters your address in hundreds of sign-up forms at once. Microsoft describes mail bombing as an attack that "typically subscribes recipients to a large number of legitimate newsletters and services," whose volume "acts as a precursor to malware, ransomware, or data exfiltration" (Microsoft). Most guides for this search come from cleanup services and lead with their tool. The order matters more than the tool: the flood is cover, so what it hides comes first, and the cleanup can wait a day.

What to do in the first hour

1. Search for what the flood is hiding. Look for mail from your bank, card issuer, shops, and any site that sends password resets or sign-in codes. Search words like "order," "password," "sign in" and "fraud."
2. Act on anything you didn't do. Call your bank on the number on your card, not one in an email. Change the password of any account with a reset you didn't ask for, and turn on two-factor sign-in.
3. Refuse the helpful caller. If someone calls or messages to fix your spam, hang up. That is the next step of a known attack.
4. Filter, don't unsubscribe. Make a filter for sign-up confirmations and welcome emails, so new real mail can reach you. Don't click the "confirm" links.

The sections below explain each step and the tools that do it.

How we checked

We read each provider's and each tool's own help, security and pricing pages on November 4, 2026, plus Microsoft's and the FTC's own guidance on the attack and on fraud. Every fact about another product links to its source. Where a page didn't say something, we say so instead of guessing. We compared what each way does in a flood, which accounts it works with, and where it runs. Alrighty is our app, and it is listed first. We didn't run tests of our own.

Ways to stop a subscription bomb at a glance

Way	Tools	When	What it does	Where it runs
Filters, Stop mail and Clean up	Alrighty	During and after	Moves the flood to Archive; leaves lists after	Your computer; AI on its server
Search for the hidden email	Gmail, Outlook, Apple Mail search	First	Finds the alert the flood buries	Your provider or your Mac
Lock down the account it hides	Your bank, the site, the credit bureaus	First	Stops the fraud the flood covers	Those companies
Ignore the "IT support" call	None	During	Avoids the remote-access scam that follows	You
A filter or rule for sign-up mail	Gmail, Outlook.com, iCloud.com, Apple Mail	During	Moves new sign-up mail out of the Inbox	Your provider or your Mac
Report it, or tell IT	Gmail, Outlook, Microsoft Defender	During	Trains the filter; work filters detect mail bombing	Your provider
Unsubscribe once it slows	Gmail, Outlook.com, Apple Mail	After	Leaves the lists you were added to	Each list
A cleanup service	Clean Email, Mailstrom, Leave Me Alone	After	Deletes and unsubscribes in bulk	The service's servers
A new address	Hide My Email, a new account	If it doesn't stop	Moves your real mail off the bombed address	Your provider

Alrighty: best for keeping the flood out of your Inbox

Alrighty is a mail app for Mac, Windows and Linux that puts iCloud, Gmail and Outlook accounts in one inbox. It has no mode made for subscription bombs. Three of its tools fit the job, each at a different stage.

• Filters, during the flood. Describe the kind of mail in your words, such as "newsletter sign-up confirmations and welcome emails," or set rules on words in the subject. New Inbox mail that fits moves to Archive before the list shows it. Mail from people you wrote to, or in a conversation you wrote in, is never moved. Nothing is deleted, so a real alert that a filter caught is still in Archive, and search finds it.
• Stop mail, after. One action on a sender unsubscribes you in every way the message offers, archives their mail, and moves their new mail out. Alrighty unsubscribes only from senders whose mail passed DMARC and wasn't marked spam, so it never confirms your address to a fake list. A real newsletter whose mail passed DMARC gets the unsubscribe. For a sender that fails, Stop mail still archives and moves its mail, but doesn't contact it.
• Clean up, after. It lists the senders you probably don't want, such as newsletters you never open, so you can stop them all at once instead of one by one.

Price. A 14-day trial with no card, then a Free plan or Pro.

Where your mail goes. Your mail stays with iCloud, Google or Microsoft, and Alrighty keeps its copy on your computer. A rule matches on your computer. A described filter asks an AI model through Alrighty's server, and only while you're signed in. Clean up sends each sender's address, three facts the receiving server found, and up to 3 of their newest emails (2,000 characters each) to Alrighty's server to sort them.

What it can't do. If the AI doesn't answer within 5 seconds, the mail stays in the Inbox, so in a heavy flood some will get through. Stop mail and Clean up still mean a step per sender or per list you review. There's no iPhone app, so what you filter on your computer doesn't screen mail on your phone first. It takes iCloud, Gmail and Outlook accounts only, not Yahoo, AOL or other IMAP. It's new, with no long track record.

Pick it if you use iCloud, Gmail or Outlook and want new sign-up mail moved out while real mail keeps arriving.

Search for the hidden email: best for the first ten minutes

The flood exists to push one message out of sight, so find it before you clean anything. Search beats scrolling. In Gmail, newer_than:2d limits a search to the last two days, and you can add words to it (Google). Try your bank's name, "order," "receipt," "password," "verification code" and "new sign-in."

Look in Spam and Junk too, in case a filter put a real alert there.

What it can't do. Search finds only what arrived. If an attacker changed your account's email address, the alerts may go somewhere else, so also sign in to your bank and main shops and look at recent activity.

Pick it if the flood started in the last day. That is everyone reading this page.

Lock down the account it hides: best when you find something you didn't do

If you find an order, a transfer or a password reset you didn't make, treat it as fraud, not spam. Call the company on a number you already trust, such as the one on your card. Change that account's password and turn on two-factor sign-in.

If the account was a bank or a card, think about your credit. The FTC says "There's no cost to place or lift a credit freeze," and you place one with each of Equifax, Experian and TransUnion. An initial fraud alert "lasts one year, but you can renew it" (FTC).

What it can't do. None of this stops the emails. It stops the reason someone sent them.

Pick it if your search turned up anything you don't recognize.

Ignore the "IT support" call: best for work accounts

Some bombs come before a phone call. Microsoft's security team described an attacker that signed people up for many email subscriptions, then called them pretending to be IT support, offering to fix the spam (Microsoft). The caller talked the person into a remote-help session with Quick Assist, took control of the computer, and installed malware that in some cases led to ransomware. Microsoft says the same attacker also messaged people on Teams with names like "Help Desk."

So during a flood, don't accept a call, chat or remote session from anyone who offers to fix it. If you need help at work, contact your IT team through a channel you already use.

What it can't do. This avoids the worst outcome but does nothing about the mail.

Pick it if the bombed address is a work or school address.

A filter or rule for sign-up mail: best for keeping new mail readable in any app

A filter on your provider's server works in every app and on your phone, and it catches mail from senders you have never seen. Bomb mail is mostly confirmations and welcome emails, so it shares words.

• Gmail. Click Show search options, put words such as "confirm your subscription" OR "welcome to" OR "verify your email" in Has the words, click Create filter, and choose Skip the Inbox (Google). Archive beats delete: a real welcome you need stays findable.
• Outlook.com. Open Settings, Mail, Rules, and add a rule that moves messages with those words to a folder (Microsoft). Microsoft says a new rule applies only to mail that arrives after you make it.
• iCloud Mail. On iCloud.com, open Settings, then Rules. Apple says a new rule can take up to 15 minutes to apply (Apple).

The full steps for each are in how to stop spam emails.

What it can't do. A filter on common words also moves real sign-up mail, such as a store you just joined. Blocking each sender is useless here: the next one is a new address. Remove the filter once the flood ends, or it will keep hiding mail.

Pick it if you need your Inbox usable today, on every device.

Report it, or tell IT: best for Microsoft 365 at work

Reporting the mail as spam moves it and teaches your provider's filter, as on any spam. In Gmail, select the emails and click Report spam (Google). In Outlook, use Mark as junk (Microsoft).

Work accounts may have more help. Microsoft says that since June 2025, Defender for Office 365 "is now able to detect and classify mail bombing attacks," and admins can see it as a detection type in their tools (Microsoft). If your company uses it, tell your IT team, who can see the attack and act on it across the company.

What it can't do. Reporting hundreds of messages by hand is slow. Defender for Office 365 is a product your company buys, and Microsoft's page doesn't say it covers personal Outlook.com accounts.

Pick it if the bombed address is a work address, or you want your provider's filter to learn.

Unsubscribe once it slows: best for the lists that keep sending

Most bomb mail comes from real lists, and some will keep sending after the flood. Once it slows, leave them. Gmail's Manage subscriptions, under More in the left column, lists the lists that send to you, with Unsubscribe next to each (Google). Outlook.com has Settings, Mail, Subscriptions (Microsoft). Our unsubscribe app guide compares these with the paid tools.

Don't click the "confirm your subscription" links. Some lists send one confirmation and add you only after you click it, so a list you never confirm may never write again.

What it can't do. It's slow across hundreds of senders, and during the flood it takes your attention from the alert you were looking for. Unsubscribe from what you recognize as a real list. Delete anything that looks like a scam.

Pick it if the flood has ended and a few dozen lists keep writing.

A cleanup service: best for clearing thousands of messages at once

A cleanup service connects to your mailbox from its own servers and acts on many messages at once.

• Clean Email sends unsubscribe requests for you and can block lists that ignore them (Clean Email). Its Screener holds mail from new senders "in quarantine for your review" (Screener), which fits a flood of new senders.
• Mailstrom groups mail so you can delete or archive thousands of messages at once, with one-click unsubscribe and block (Mailstrom). Plans are $9, $14 or $29.95 a month for 1, 3 or 20 accounts, and Basic stops at 10,000 emails (pricing).
• Leave Me Alone lists your subscriptions to opt out of, and for Gmail and Microsoft accounts it creates filters for mail it can't unsubscribe you from (security). It unsubscribes from 10 emails for free; paid plans start at $48 a year (pricing).

Our bulk delete guide compares more tools for the delete step.

What it can't do. Each one is another company with access to your mailbox, at a time when someone is attacking it. Each reads your mail on its servers.

Pick it if thousands of messages are left after the flood, and your mail app can't select them fast enough.

A new address: best if it doesn't stop

If the flood keeps coming back, move the mail that matters to a new address. Give your bank and your main accounts the new one, and keep the old one for anything else. Apple's Hide My Email, part of iCloud+, makes addresses that forward to your real one, which you can turn off later (Apple).

What it can't do. It's the most work on this page, and every account you forget to update keeps writing to the old address.

Pick it if you've been bombed more than once.

How to choose

• iCloud, Gmail or Outlook, and you want sign-up mail moved out as it arrives: Alrighty's Filters, then Stop mail and Clean up.
• The flood started today: search for your bank, shops and password resets first.
• You found something you didn't do: call that company, change the password, think about a credit freeze.
• Someone calls to fix your spam: hang up.
• You need a usable Inbox on every device: a filter in Gmail, Outlook.com or iCloud on sign-up words.
• It's a work address: report it and tell IT, especially on Microsoft 365.
• The flood is over and lists keep writing: Gmail's Manage subscriptions or Outlook.com's Subscriptions.
• Thousands of messages left over: Mailstrom or Clean Email.
• It keeps happening: move important accounts to a new address.

Questions

Why would someone subscription bomb me?

Most often to hide something: a purchase on your card, a change to an account, or a password reset, buried under hundreds of emails. Microsoft also describes it as the first step before a fake IT support call. Sometimes it's harassment with no other goal. Either way, check your accounts before you clean up.

How long does a subscription bomb last?

There's no fixed length, and the providers we read don't give one. The sign-ups usually happen in a short burst, and the newsletters you were added to can keep sending after it. Leave your filter in place until the mail slows, then unsubscribe from what's left.

Should I unsubscribe from every email in the flood?

Not during it. Unsubscribing from hundreds of senders takes hours and pulls you away from the alert you need to find. Filter first, and unsubscribe later from the lists that keep sending. Don't click any "confirm" link.

Can I find out who did it?

Usually not. The emails come from real newsletters and sites, not from the attacker, and the sign-ups were made by a bot. What you can do is find what the flood was hiding and protect that account.

Will Gmail or Outlook stop a subscription bomb on its own?

Not entirely. Each message is a real sign-up from a real sender, so it looks like normal mail to a spam filter. Microsoft's Defender for Office 365 can detect and classify mail bombing for companies that use it. For a personal account, your own filter is the fastest fix.