Why am I suddenly getting so much spam?
A slow, steady trickle of spam is part of having an email address. A sudden flood is different. When you go from a few junk emails a week to dozens a day, something specific has usually changed, and finding out what tells you how to fix it.
Here are the eight most common causes, starting with the one you should rule out first.
1. Someone is hiding something from you (subscription bombing)
If you suddenly receive hundreds of emails in a short time, mostly "welcome", "confirm your subscription" and newsletter sign-ups from real websites all over the world, stop and pay attention. This pattern is called subscription bombing, or an email bomb, and it's often a distraction.
Criminals who have stolen your card or account details use automated tools to sign your address up to thousands of mailing lists at once. The goal is to bury the one email that matters: a purchase confirmation, a password change alert or a fraud warning from your bank.
What to do right now:
- Search your inbox for your bank, payment apps, shops and your email provider. Look for orders, payments or security alerts you don't recognise.
- Check your bank and card statements directly in your banking app.
- Change the passwords of your email and financial accounts, and turn on two-step verification.
- Check your email account for strange sign-ins and forwarding rules (see signs your email has been hacked).
Most of these sign-up emails stop within a few days, because unconfirmed subscriptions expire. Filters for words like "confirm your subscription" can keep your inbox usable in the meantime.
2. Your address appeared in a new data breach
When a company's user database is stolen and the list starts circulating, spam and phishing to those addresses rise sharply. It can happen with a site you haven't used in years. Check your address on a breach service like Have I Been Pwned; our guide How to know if your email was leaked walks through it, and what to do with the result.
3. You signed up for something recently
Think back over the last few weeks. A contest, a free download, a new shopping app, a Wi-Fi login, a store loyalty card? The small print often allows a company to share your address with "carefully selected partners", which in practice can mean many companies you've never heard of.
If the new emails are from real companies, use their unsubscribe links. That's safe for legitimate senders and legally required in many countries. In future, give a temporary email address to sign-ups like these; the "partners" will be sending to an address that no longer exists.
4. You replied to spam, or clicked "unsubscribe" in obvious junk
With genuine companies, unsubscribing works. With obvious junk, like fake prizes and miracle pills, any response, including a reply or a click, confirms that a real person reads your inbox. That makes your address more valuable, and it gets sold on to more lists. The same goes for loading images in spam emails, which can include tracking pixels.
For spam from senders you've never dealt with, don't engage at all: just use the Report spam button.
5. Your address was published somewhere
Automated programs constantly crawl the web looking for anything that looks like an email address. If yours recently appeared on a public page, like a business website, a forum post, a CV uploaded to a job board, a public document or a social profile, expect spam within days.
If you need to show an address on a website, use a contact form instead, or an address you're happy to filter heavily. See how spammers get your email address for the full list of ways it happens.
6. Your spam filter changed, not the spam
Sometimes there's no more spam than before; it's just getting past the filter. This can happen when:
- you've marked lots of similar emails as "not spam", which teaches the filter to let them in;
- you've moved to a new email app that doesn't use your provider's filtering the same way;
- you've set up forwarding from another account, which can bypass some filtering;
- your work's IT team changed the filtering system.
Consistently using Report spam (rather than just deleting) is the fastest way to retrain the filter.
7. A spammer is using your address as the sender
If what's flooding in is bounce messages ("Undeliverable", "Mail delivery failed") for emails you never sent, a spammer is putting your address in the "From" field of their spam. When their messages fail, the bounces come back to you. This is called backscatter.
It doesn't mean your account was hacked. Check your Sent folder; if it's empty of these messages, you're a victim of spoofing. It usually stops by itself within days. If you own a domain, setting up DMARC stops most of it (see SPF, DKIM and DMARC, explained simply).
8. It's a seasonal wave
Spam follows the calendar. Volume rises around shopping events like Black Friday, before tax deadlines, during big sporting events, and around the holidays, with fake delivery notifications at their peak. If the spike matches the season, it will fade by itself.
How to bring your inbox back under control
- Report, don't just delete. Every report trains your filter and helps other users.
- Use your email app's Unsubscribe button for legitimate newsletters. It works without visiting the sender's site.
- Create filters for recurring patterns, like a particular sender or phrase.
- Block repeat senders, although spammers change addresses so often that filters and reporting are usually more effective.
- Protect the address going forward. Use a Gmail alias for accounts you keep and a temporary email for one-time sign-ups. Our guide How to stop spam emails covers nine habits that work.
When to consider a new address
If spam still makes your inbox unusable after a few weeks, especially if your address has been in several breaches or published widely, a fresh address can be worth the effort. Move your important accounts first, set up forwarding from the old address for a few months, and this time keep the new one private: real address for people and important accounts, aliases and temporary addresses for everything else.