Why Am I Getting So Many Spam Emails All of a Sudden?

If you’re suddenly getting so many spam emails, someone has usually signed your address up to hundreds of lists at once (an email bomb), your address leaked in a breach or was sold after a signup, or spammers are forging it as the sender. Less often, your account was broken into, a filter or app change is letting more through, or someone is guessing names at a domain you own. The kind of mail arriving tells you which. Check for fraud first: an email bomb is often cover for a purchase or password reset you’re meant to miss. For the next time, CatchNone gives every shop, newsletter, and account its own address on iPhone, iPad, and Mac, so a spike lands on one alias and shows where it came from.

Rule the causes out in this order, most urgent first:

1. An email bomb: dozens or hundreds of signup confirmations an hour.
2. A compromised account: mail sent from your account that you didn’t write, or settings you didn’t change.
3. A breach or spam list: a steady rise in junk from senders you’ve never heard of.
4. A sale or share after a signup: marketing from companies you’ve never dealt with.
5. Spoofing: spam, or bounce messages, “from” your own address.
6. A filter or app change: the same mail, sorted differently.
7. Dictionary guesses on a catch-all domain: mail to made-up names at a domain you own.

First, make sure the spam isn’t hiding fraud

An email bomb attack floods one address with mail. Its common form, subscription bombing, uses real confirmation emails from real companies: someone enters your address into signup forms across many sites. Security researchers describe bursts of more than 1,500 emails an hour, and Yahoo lists the aims, including “To hide confirmation emails for financial transactions.”

If your inbox is filling with “Confirm your subscription” and “Welcome” messages, spend ten minutes on this first:

1. Open your banking and card apps directly, not through links in email, and look for payments you don’t recognize. If you find one, the FTC says to report it to the card issuer or bank immediately, using “the number on the back of your card” or its app.

2. Sign in to the shops that have your card saved and check recent orders.

3. Search your mailbox, Spam and Trash included, for what the flood may be burying: password resets, sign-in alerts, changed recovery details, and order and payment confirmations. In Gmail, this search covers the last week; change 7d to reach back to when the flood started:

   in:anywhere newer_than:7d {subject:password subject:security subject:"sign in" subject:login subject:recovery subject:order subject:receipt subject:payment}

   In Outlook.com, iCloud Mail, or Yahoo, search for those words one at a time.

4. If you find anything you didn’t do, change that account’s password on its own website or app, then work through the hacked-account checks below.

Expect one more move. In attacks documented by CISA and Microsoft, the flood was followed by a call or Microsoft Teams message from someone posing as IT support, offering to fix the spam and asking the victim to install a remote-access tool such as Quick Assist or AnyDesk. Microsoft says: “If you didn’t ask us to, we won’t call you to offer support.” Hang up, or ignore the message. On a work account, contact IT through a channel you already use.

So many spam emails all of a sudden? Match the pattern to the cause

A sudden increase in spam emails leaves clues in the mail itself. Find the row that matches what you see:

What to do when you’re email bombed

You can’t stop email bombing at the source, because the mail comes from real signup forms. You can keep it out of your way without losing the one message that matters:

1. Don’t click Confirm or Verify links in the flood. On double opt-in lists, you aren’t added until you click; Mailchimp, for example, adds a contact only after they “click a link to verify their email.” Not every list asks for confirmation, so some will keep sending.
2. Don’t bulk-delete, and don’t block senders one by one. A bulk delete can take the one security email with it, and senders that change their address get past blocks.
3. Make one temporary filter. Have it move the confirmations to a folder or label, leave out anything about passwords, security, orders, or payments, and never delete. Make it on your provider’s website: the new Outlook for Windows doesn’t run rules for Gmail, Yahoo, or iCloud accounts.
4. Look through that folder once a day. Repeat the bank and order checks for a few days.
5. Remove the filter when the flood stops. Then unsubscribe from the lists that keep sending, with each sender’s own link or, in Gmail, More → Manage subscriptions (still rolling out as of September 2026). They belong to real companies, so unsubscribing usually works. Actual spam is different: see when unsubscribe links can be malicious.

A filter that keeps security mail in view

In Gmail, this matches common confirmation subjects and leaves out security and order mail. Change the words to match what you’re seeing:

{subject:confirm subject:subscription subject:welcome subject:newsletter subject:verify} -subject:password -subject:security -subject:"sign in" -subject:login -subject:code -subject:order -subject:receipt -subject:payment

1. On a computer, paste it into the search box at the top of Gmail and press Enter. Check that the results are the flood and nothing you need.
2. Click Show search options, check the criteria, then click Create filter at the bottom of the search window.
3. Choose to skip the inbox and apply a new label, such as Flood. Don’t choose to delete.
4. Click Create filter. Gmail’s filter help has the full steps.

Elsewhere, as of September 2026:

How to check whether your email account was hacked

More spam coming in doesn’t, on its own, mean your email account was broken into, though a flood can cover a takeover attempt. Clearer signs are mail going out that you didn’t send (which brings bounces and replies back in) and settings you didn’t change. The FTC, Google, and Apple list the signs: friends get emails from you that you didn’t send, your Sent folder has messages you didn’t write, you get alerts about a sign-in or password change that wasn’t you or a two-factor code you didn’t ask for, or you can’t sign in.

If you can’t sign in, start with the provider’s recovery steps instead: Google, Microsoft, or Apple. Otherwise, work in this order, from a device you trust:

1. Change the password. Google and Apple revoke app passwords when you do. Microsoft’s help doesn’t say whether it does, so remove them by hand.
2. Remove forwarding, filters, delegates, and app passwords you didn’t set up. A forwarding rule can outlive a password change.
3. Review recent sign-ins and devices. Sign out any you don’t recognize.
4. Check your recovery email and phone number. Then turn on two-step verification.
5. Look through Sent and Trash. Find mail the intruder sent or read, and warn anyone who got something from “you.”

Where to look, from each provider’s help pages as of September 2026:

Gmail and your Google Account

• Security events: Google Account → Security & sign-in → the Recent security events panel → Review security events. For any event you don’t recognize, select No, it wasn’t me.
• Devices: Google Account → Your devices → Manage devices.
• Recent Gmail access: at the bottom right of Gmail on a computer, click Details to see the last 10 IP addresses and access types, such as IMAP. If you use Gmail on a phone, the list may show your carrier’s location, which can be far from where you are.
• Gmail settings: Settings → See all settings, then the Forwarding and POP/IMAP tab, Filters and Blocked Addresses, and the Grant access to your account section under Accounts and Import.
• Apps: remove anything unfamiliar from app passwords and apps with access to your account.

Outlook.com, Hotmail, and your Microsoft account

• Sign-ins: the Recent activity page covers the last 30 days, though not every sign-in. If an Unusual activity section appears, review each item; for any that wasn’t you, choose This wasn’t me. For anything suspicious in the Recent activity list, select Secure your account.
• Forwarding and rules: in Outlook.com, Settings → Mail → Forwarding (clear Enable forwarding and select Save), and Settings → Mail → Rules.
• App passwords and sessions: under Advanced security options on your Microsoft account dashboard, check the App passwords section and use Sign out everywhere, which Microsoft says takes up to 24 hours.
• Other settings: Microsoft’s recovery steps also say to check “connected accounts, forwarding, and automatic replies.”

iCloud Mail and your Apple Account

• Devices: on account.apple.com, select Devices and remove any you don’t recognize.
• App-specific passwords: account.apple.com → Sign-In & Security → App-Specific Passwords → Remove, or Revoke all. Changing your password revokes them all anyway.
• Forwarding and rules: on icloud.com/mail, select the Settings button at the top of the Mailboxes list → Settings, then check Mail Forwarding and Rules in the sidebar.
• Sign-in history: Apple doesn’t document a log like Gmail’s. Its signals are sign-in alerts, two-factor codes you didn’t request, and the Devices list.

Was your email in a new data breach?

Search for your address on Have I Been Pwned (HIBP), a free service run by security researcher Troy Hunt. As of September 25, 2026, its home page counts 1,038 pwned websites and more than 17 billion pwned addresses (an address found in several breaches is counted once for each).

• A breach result names the service that lost your address and when. A recent one can explain a rise in spam and phishing.
• A spam list result means your address was found in data used for targeted spam, which explains spam directly.
• No result doesn’t prove much: “Many breaches never result in the public release of data.”
• Search every address you use separately, plus addresses included, and turn on HIBP’s free Notify Me alerts.

A breach can also show up as an email that quotes one of your passwords and demands payment. The FTC’s advice: “Stop. Don’t pay anything. Delete the message. It’s a scam.” If you still use that password, change it everywhere. For the other routes your address can take, see how spammers get email addresses.

Your address was sold or shared after a signup

If the new mail is ordinary marketing from companies you’ve never used, and it started soon after you signed up somewhere, your address was probably passed on. The FTC says that when you give a company your email address, “it might share or sell it to third parties.” Microsoft points to one way in: a check box at checkout, already selected, that lets the shop pass your address to other businesses.

1. Unsubscribe from the real companies. Use each sender’s own link or, in Gmail, More → Manage subscriptions. In the US, CAN-SPAM says a sender must honor your opt-out “within 10 business days” and then “can’t sell or transfer” your address.
2. Turn off sharing where you signed up. In your account at that company, look for marketing or partner-sharing settings and switch them off.
3. Trace the source. To work out which signup leaked, see how to find out who sold your email address. Next time, give each signup an alias of its own, as CatchNone does, so the next sale names its source.

Why am I getting spam from my own address?

Mail showing your own address as the sender is often forged rather than sent from your account. In the words of the SPF standard, “existing protocols place no restriction on what a sending host can use as the ‘MAIL FROM’ of a message.” Three checks exist to catch forgeries:

• SPF (RFC 7208) lists the servers allowed to send mail for a domain.
• DKIM (RFC 6376) adds a cryptographic signature to each message, which receiving servers check against a public key the sending domain publishes in its DNS.
• DMARC (RFC 9989, which replaced RFC 7489 in May 2026) tells receiving servers what the domain wants done with mail that fails those checks: no preference, so the receiver decides (none), treat it as suspicious (quarantine), or refuse it (reject).

To tell spoofing from a hack:

1. Open your Sent folder. Forged mail never passes through your account, so it won’t be there. An intruder can delete sent items, though, so check your sign-in activity too.
2. Check the message’s authentication. In Gmail, a question mark next to the sender’s name means the message “isn’t authenticated”; click the Down arrow below the sender’s name to see Mailed by and Signed by. In Outlook, a “?” in the sender image of someone who doesn’t normally have one “could be a sign the sender is being spoofed.” For the full results in Gmail, click More next to Reply, then Show original (Google); in other apps, find the Authentication-Results header.
3. Read the result. spf=fail, spf=softfail, or dmarc=fail on mail showing your address usually means it was forged: filter it and move on. If the forged address is on a domain you own, publishing SPF, DKIM, and a DMARC policy of quarantine or reject lets receiving servers send the fakes to spam or refuse them outright. A DKIM pass signed by your provider’s own domain (Signed by gmail.com, for example) suggests it may really have come through your account, so work through the hacked-account checks.

A pile of “Undeliverable” messages for mail you never sent is the same forgery seen from the other side. Microsoft calls it backscatter: spammers put a real address on their mail, and servers that can’t deliver it send the bounce to that address. It doesn’t mean your account was used: check Sent, then filter the bounces until they stop.

Your filters or mail app changed, not the spam

Sometimes the mail is the same and only the sorting changed:

• Gmailify is ending. Gmail stops screening Yahoo, Outlook, and other accounts linked through Gmailify in January 2027, or sooner if you move one to the Gmail app over IMAP; from then, that provider’s own spam filter decides what you see unless you forward its mail to Gmail.
• iPhone Mail categories. Since iOS 18.2, Mail can sort mail into Primary, Transactions, Updates, and Promotions (not in all countries or regions). If the inbox was switched to List View (the More button at the top of the inbox → List View), mail that used to sit under Promotions and Updates is now in the main list (Apple).
• Something is skipping the junk folder. A filter set never to send mail to spam, or junk that seems to come from a contact, can land in your inbox; iCloud says mail “from people in your iCloud contacts, or from recent conversations, won’t go to the Junk folder” (Apple). Check your filters, and mark junk as spam rather than deleting it.
• New Outlook for Windows. Rules you relied on in classic Outlook may have stopped sorting Gmail, Yahoo, or iCloud mail. Set them up at the provider, as in the filter steps above.

Mail to made-up names at your own domain

A catch-all accepts mail for any address at your domain, misspelled ones included. Spammers guess common names such as info@, admin@, and sales@, and a catch-all turns none of them away.

Drop the names being hit, or turn off the catch-all and create only the addresses you use. If you rely on the catch-all for per-site addresses, turning it off means creating each one at your provider first. Many mail providers let you add a rule for one guessed address. A rule that silently drops its mail gives the guesser no bounce, so the address can look valid and they may keep sending; a rule that bounces it tells them the address doesn’t exist, while the rest of your domain keeps receiving. Host-by-host steps to block one address are in how to stop one address on a catch-all.

How long a spam spike lasts

If you’ve been getting a lot of spam emails lately, whether it stops depends on the cause:

• An email bomb usually ends in about a week, Yahoo says, though lists that signed you up without asking for confirmation keep sending until you unsubscribe.
• Unsubscribes can take up to 10 business days to take effect in the US, under CAN-SPAM.
• Breach and list-sale spam tapers off but rarely stops; see what cuts it over time.
• Spoofing and backscatter end when the campaign moves on.
• A compromised account stops sending once the intruder is out.

Report phishing beyond your mail provider: in the US, forward it to reportphishing@apwg.org and report it at ReportFraud.ftc.gov; in the UK, forward it to the NCSC at report@phishing.gov.uk.

Trace the next spike with CatchNone

CatchNone makes the next spike easy to trace. When each shop, newsletter, or account has its own alias, extra mail lands on one alias and names its source, and each message is badged with the alias it reached. Activity charts mail per alias, and a simple rule adds a “More mail than usual” note. Alias mail is read in its own app, and messages open with remote images, including most tracking pixels, blocked until you load them.

When an alias turns noisy, switch it off: on a @catchnone.com address (Premium), senders get a bounce, while your other aliases keep working. On a domain you own, marking an alias as not in use is only a label, so block the address with a rule at your provider. A flood to @catchnone.com also counts against the daily limits of 500 incoming messages per UTC day, at most 250 to any one address, and mail over them is refused for now without a warning in the app. On your own domain, CatchNone reads the newest 100 inbox messages per check, so a very large flood is undercounted.

CatchNone is receive-only by design. It has no spam filter and doesn’t clean up a flood that’s already hitting your main address, and it checks for mail when you open it rather than sending notifications, so keep bank and account-recovery mail on your main address. Download CatchNone for iPhone, iPad, and Mac.

FAQ

Is email bombing illegal?

That depends on where you live, and this isn’t legal advice. The fraud it often covers is what to report: tell your bank about any payment you didn’t make, and in the US report fraud at ReportFraud.ftc.gov and identity theft at IdentityTheft.gov.

Why is my Outlook, Hotmail, or Yahoo getting so much spam?

The causes are the same on every provider, and only the places to check differ: see the Microsoft account checks and the Outlook.com and Yahoo rows of the filter table.

What should I do in the first hour?

Check your bank and card apps, recent orders, and your mailbox, Spam and Trash included, for password, security, and order emails, as in the fraud checks above. If anything points to a break-in, run the hacked-account checks; then filter the flood into a folder without deleting it, and ignore anyone who calls or messages offering to fix the spam.