What is email subscription bombing, and what do I do about it?

Last reviewed: October 29, 2026 · Markdown version

It is an attack where your address is signed up to so many lists that your inbox fills with confirmation emails and newsletters. In Google's account of it, the flood is cover for one email you are meant to miss.

Google does not use the phrase "subscription bombing". Its name for the attack is a mailbomb, "a form of attack designed to prevent you from using your email account or finding legitimate emails", and it explains the motive in plain terms: "In a targeted attack, a hacker can try to fill up your inbox so that you can't find important security alerts from websites or services you signed up for with your Gmail account. For example, if a hacker tries to get into your bank account, your bank can notify you by email. But if your inbox is full of junk mail, you might miss the bank’s alert." (Manage unwanted messages in Gmail, read 29 October 2026.) Google adds that "an attacker only needs to know your email address".

Do this first, before you delete anything

Google's list for anyone who sees its mailbomb warning (the page above):

"Search your inbox and spam for security alerts, then respond to the email you find."
"Do a Google Security Checkup."
Follow Gmail's security tips.

The first step is the one that matters most, and it is the one a mass delete would destroy. In practice it means searching for words a real alert would contain, such as "sign-in", "password", "order" or "payment", and the names of your bank and the shops where you hold an account. Then check those accounts directly, by typing the site's address yourself rather than following a link in the flood. Those search terms and the direct-login habit are our suggestions, not Google's wording.

Thinning the flood

Let categories catch it. Google suggests turning on inbox categories, so that "you don't have to view all email and separate messages that you might want to read later" (the page above).
Search it out. Google's examples are list: for mailing-list mail, noting that "Mailing lists are typically used in spam attacks", and a category with a date, category:updates newer_than:1d. A filter can then send matching mail "directly to the Trash".
Report what is spam. "As you report more spam, Gmail identifies similar emails as spam more efficiently" (Report spam in Gmail, read 29 October 2026).

A caution of our own on filters: an attack signs you up to real companies' lists, and a broad filter written in a hurry can also catch the shop or bank you actually use. Keep each filter to the senders in the flood.

Where Adinand Email Cleaner helps, and where it does not

After you have looked for the alert, the flood is a cleanup job, and that is what Adinand Email Cleaner does. It groups your Gmail by sender and category, so a few hundred unfamiliar senders show up as a list you can work down, and it moves whole groups to Trash in bulk. It works with Gmail only. It moves mail to Gmail's Trash and cannot delete permanently, so anything you clear stays recoverable there for Gmail's 30 days, which is a safety net if the alert was in the pile, and means the space comes back only after Trash clears. It cannot tell an attacker's sign-up mail from a genuine alert; that check is the step above, and it is yours.