Mail bombing is the deliberate sending of a large burst of email to overwhelm a person’s inbox and attention. The flood can bury important messages, alerts, or evidence of suspicious activity, making it harder for a target to notice what is happening.
In social-engineering attacks, inbox flooding may create confusion or urgency before an attacker contacts the target through another channel, such as an external workplace chat posing as IT support. The email flood is not itself proof of a successful compromise, but it is a warning sign. Users should avoid acting on unsolicited support requests, verify the sender through a trusted channel, and report unusual email volume to their security team. Defenders can investigate mail logs, apply filtering and rate limits, and check whether the flood coincides with suspicious login or support activity.