A few years back, a friend of mine watched her phone ring more than two hundred times in a single afternoon. Every call came from a different number, so blocking them did nothing. While she was busy swiping away calls, the texts started. Then her email inbox began filling up with newsletter confirmations in languages she doesn't speak. By dinner, she was ready to throw her phone in a lake.
The next morning, she figured out what the whole show was actually about. Someone had gotten into her Amazon account and changed the shipping address, and the order confirmation email had been buried under roughly three thousand junk messages. The flood wasn't the attack. The flood was the curtain the attacker hid behind while they did the real work.
What she went through has names. Call flooding, SMS bombing, and email subscription attacks are three flavors of the same idea, and they've gotten cheaper and easier to pull off every year. If it ever happens to you, or it already has, this guide will walk you through what's going on, why it's happening, and exactly what to do about it.
What Are These Attacks, Exactly?
All three attacks share the same basic mechanic: overwhelm a communication channel so badly that it becomes useless, annoying, or both. But each one works a little differently, and the differences matter when you're trying to defend yourself.
Call flooding, sometimes called call bombing or telephony denial of service (TDoS), is when your phone rings constantly for hours or days. The calls almost always come from spoofed numbers, which is why blocking them one at a time feels like bailing out a boat with a spoon. The person behind it is usually using an autodialer running through cheap VoIP services, and they can rotate through thousands of fake caller IDs without breaking a sweat.
SMS bombing is the text message version. Your phone starts buzzing with hundreds of messages, and here's the part that confuses people: a lot of those texts are legitimate. They're verification codes and order updates from real companies you've never contacted. Attackers use scripts that hammer websites with "text me a code" forms, plugging in your number across hundreds of sites at once. Your phone becomes the landing zone for a pile of one-time passwords meant for nobody.
Email bombing comes in two varieties. The crude kind is a direct flood, where a botnet spams your inbox with thousands of messages from throwaway addresses. Most decent email providers catch a lot of this. The sneakier version is the subscription attack, sometimes called list bombing. A bot crawls the web looking for newsletter signup forms, then enters your email address into thousands of them in a matter of hours. Suddenly you're "subscribed" to mailing lists for real estate agents in Ohio, gardening clubs in Sweden, and every coupon site on the internet. Because those emails come from legitimate companies with real sending reputations, they sail right past your spam filter.
Why Would Anyone Do This?
Understanding the motive matters, because it tells you how worried you should be. In my experience reading about and dealing with these incidents, the reasons fall into four buckets.
The Smokescreen
This is the big one, and it's the scenario that should make you sit up straight. When an attacker has already stolen your login credentials, maybe from a data breach or a phishing email you fell for months ago, they have a problem. The moment they change your password, update your shipping address, or move money out of your account, the company involved is going to send you a notification. "Was this you?" is the last thing an attacker wants you to read.
So they bury it. They flood your email, your texts, and sometimes your phone line all at once, and that one critical alert from your bank drowns in a sea of junk. The attack is loud and chaotic on purpose. It buys them hours or even days while you assume you're just dealing with a spam wave.
Harassment
Sometimes it's personal. Angry exes, online arguments that escalated, disgruntled customers or employees. Flooding someone's phone is a cheap way to make their life miserable, and the people who do it for this reason usually want you to know it's deliberate.
Extortion
Less common but it happens: the flood starts, then a message arrives demanding payment to make it stop. Paying is a bad idea for all the usual reasons. It confirms you'll pay, and it rarely ends anything.
Attacks on Businesses
TDoS isn't just a consumer problem. Small businesses that rely on a single phone line, think medical offices, restaurants, contractors, can be effectively shut down by a call flood. Call centers have been hit with floods timed to distract staff during fraud attempts, same smokescreen logic, bigger scale.
The Warning Signs You're Looking at a Smokescreen
This is the part most articles skip, and honestly it's the most valuable thing I can tell you. A random harassment flood and a cover-up flood look identical from the outside, but a few clues can tell them apart.
Pay close attention if the flood starts completely out of nowhere, with no argument, no grudge, no obvious reason for anyone to target you. That's the signature of a smokescreen, because the attacker doesn't care about you personally. They care about what's in your accounts.
Watch for multiple channels getting hit at the same time. Calls plus texts plus email, all starting within the same hour, suggests coordination, and coordination suggests a plan.
And here's the big tell: somewhere in that pile of garbage, you spot messages from your bank, your email provider, Amazon, PayPal, or anywhere you keep money or personal data. Password reset confirmations you didn't request. Login alerts from devices you don't own. If you see even one of those, stop treating this as a spam problem and start treating it as a break-in.
What to Do If You're Getting Flooded Right Now
The order of operations matters here. Most people start by trying to stop the noise, and that's backwards. Secure your accounts first, then deal with the chaos.
-
Take a breath and don't shut your phone off. You need it. Your bank's fraud department and your carrier are going to be part of the fix, and some recovery processes will call or text you.
-
From a device you trust, check your critical accounts directly. Open your banking app, your email, Amazon, PayPal, anywhere money or identity lives. Type the addresses yourself or use official apps. Do not click links in any of the messages flooding in, because a flood is a great place to hide one real phishing attempt.
-
Search your flooded inbox instead of scrolling it. Use keywords like "password," "reset," "verification," "order," "sign in," and "security." This is how you find the needle the attacker was trying to hide. My friend found the Amazon confirmation this way, about nine hours too late.
-
If you find anything suspicious, call your bank's fraud line using the number printed on the back of your card. Same logic for any other compromised service. Speed matters here because fraud windows close fast.
-
Change your passwords, starting with your email account. Your email is the master key to everything else, since it's where every reset link goes. Then work outward to banking and shopping accounts.
-
Switch to app-based two-factor authentication wherever it's offered. If someone is flooding your SMS, you do not want your security codes arriving by text anyway. An authenticator app keeps those codes out of the chaos entirely.
-
Contact your mobile carrier. Every major US carrier has spam and fraud tools, like T-Mobile's Scam Shield, AT&T's ActiveArmor, and Verizon's Call Filter. Beyond the apps, their support teams can sometimes apply network-level filtering during an active flood, and they'll have a record if you need one later.
-
Use your phone's built-in defenses. On iPhone, Silence Unknown Callers sends anything not in your contacts straight to voicemail. Android's call screening through Google is genuinely excellent. Do Not Disturb with exceptions for your contacts keeps your real life reachable while the flood burns itself out.
-
Report it. File complaints with the FTC and the FCC, and if money moved or extortion is involved, report to the FBI's IC3 and your local police. Reports feel pointless in the moment, but they're how these operations eventually get shut down, and you'll want the paper trail if this turns into a fraud dispute.
Handling Each Attack Type Specifically
For call flooding, the "silence unknown callers" approach is your best friend, because the spoofed numbers make blocklists useless. Most floods are short lived since running them costs the attacker money and effort. If one drags on for weeks, which is rare, your carrier can discuss more aggressive options, up to and including a number change as a last resort.
For SMS bombing, never reply to any of the messages, not even "STOP," because you can't tell which senders are legitimate companies and which are the attacker's own infrastructure. In the US, you can forward spam texts to 7726 (it spells SPAM), which helps carriers tune their filters. Turn on your phone's "filter unknown senders" option so the flood at least stops buzzing at you.
For email subscription attacks, here's a nuance worth knowing. The newsletters in a subscription bomb come from real companies, so their unsubscribe links actually work and are safe to click. The problem is doing that thousands of times is miserable. The smarter move is to create a filter or rule that sweeps the flood into a folder so your real inbox stays usable, then search that folder for the security alerts that matter. Most subscription floods fade within days, partly because well-run lists use confirmation emails that the attacker can't complete. For the direct spam bomb variety, where senders are shady and links are sketchy, don't click anything at all. Just filter and report.
Protecting Yourself Before It Ever Happens
Since the scariest version of this attack starts with stolen credentials, prevention is mostly boring hygiene that pays off big.
Use a unique password for every account, stored in a password manager. Check whether your email has shown up in data breaches using a service like Have I Been Pwned, and change passwords on anything that's been exposed. The smokescreen attack depends on a door you forgot to lock.
Separate your identities a little. Use a masked email service like Apple's Hide My Email, Firefox Relay, or SimpleLogin for signups and shopping, and keep your primary address for banking, work, and people you actually know. Same idea with your phone number: a free secondary number from something like Google Voice can absorb the risk of every form that demands digits, while your real number stays in a much smaller circle.
Prefer push notifications and authenticator apps over email and SMS for account alerts and security codes. And turn on every account alert your bank offers. An attacker can flood one channel, but flooding your email, your texts, and your push notifications while also staying hidden is a much harder trick.
If You Run a Website or Business
Quick word for anyone on the other side of this. If your site has a newsletter signup form, that form can be weaponized against strangers. Bots love forms with no protections because every submission sends a real email from your domain to a victim who never asked for it, which trashes your sender reputation on top of everything else.
The fixes are standard and cheap: add a CAPTCHA, use double opt-in so nothing sends until the recipient confirms, rate limit submissions by IP, and drop in a hidden honeypot field that bots fill out and humans don't. Double opt-in alone defangs most subscription bombing done through your forms. On the phone side, if your business lives and dies by its phone line, ask your carrier about TDoS mitigation and make sure customers have a backup way to reach you.
Yes, This Is Illegal
For whatever it's worth, none of this exists in a legal gray area. In the US, these attacks can violate the Computer Fraud and Abuse Act, the Truth in Caller ID Act's rules on spoofing, wire fraud statutes when theft is involved, and a stack of state harassment laws. People have done real prison time for telephony denial of service and harassment campaigns. If you're a victim, that legal weight is worth leaning on when you file reports.
The Bottom Line
If your phone and inbox ever explode out of nowhere, resist the urge to treat it as a really annoying spam day. Assume, just for the first hour, that someone might be hiding something in the noise. Check your accounts, search for the alerts that matter, lock things down, and then deal with the flood itself.
Most of these attacks burn out fast once the attacker gets what they wanted or realizes you're not paying the ransom. The victims who get hurt are the ones who spend that first day fighting the noise instead of asking why the noise showed up at all. Now you know to ask.