Someone Is Using My Email Address to Sign Up for Accounts: What It Means and What to Do

You open your inbox and find a wave of confirmation emails for accounts you never created. A fitness app in another country. A coupon site you've never heard of. A gaming platform you don't use. It's disorienting, and it's fair to wonder whether you've been hacked.

You probably haven't. But that doesn't mean you should ignore it.

What you're experiencing has a few possible explanations, ranging from a harmless typo to a deliberate attack meant to distract you while something worse happens in the background. The difference matters, and knowing how to tell them apart can save you from real financial harm.

Here's what's likely going on, how serious it could actually be, and what to do right now.

Why would someone use your email address to sign up for things?

There are a few different explanations, and the right response depends on which one fits.

A typo that landed in your inbox. The most common cause is simple: someone entered their email address wrong when signing up for a service, and yours is close enough that the confirmation landed in your inbox. Maybe they misremembered a dot, swapped a letter, transposed two characters, or just made an honest mistake while filling out a form on their phone. This happens constantly, especially with short or common email addresses, think anything with a common first name, a number suffix, or a generic word. Krebs on Security described how his own long-held Gmail address was used by strangers for many years, including for tax-prep, password-manager, and bank-related accounts, so he received sensitive mail meant for other people. In one case, monthly investment statements for a stranger arrived for several years.

Someone is intentionally using your address. In some cases, a person is deliberately entering your email when they don't want to hand over their real one. They're signing up for something they'd rather not have tied to them (a promotional offer, a site they're embarrassed about, or a service they expect to spam them) and treating your inbox as a throwaway. Frustrating, but usually harmless in practice.

It might be part of a larger scheme. This is where things get more serious. The documented reasons for flooding an inbox with sign-ups are to hide important alerts and to set up a follow-up scam. A single sign-up confirmation from an unfamiliar service isn't alarming on its own, but combined with other signals it can be an early warning.

Subscription bombing. This is the scenario that deserves the most attention. Subscription bombing, also called email bombing, involves signing a target's address up for hundreds or thousands of services all at once, often using automated scripts that can process sign-up forms faster than any human could. The goal isn't the newsletters. The goal is the noise. Microsoft Threat Intelligence describes attackers signing targeted emails up to many subscription services to flood them, and Krebs documented addresses subscribed to thousands of mailing lists, in part because many lists don't confirm sign-ups. Because the messages come from real senders, they can slip past spam filters, and the sheer volume can bury the alerts that actually matter. When your inbox goes from quiet to chaotic in the span of a few minutes, that's the pattern to watch for.

What's the real risk?

A few random sign-up confirmations spread across a few days? Probably nothing. A sudden flood of them arriving within minutes of each other? That's worth taking seriously.

The most dangerous version of this plays out like a distraction. Attackers use automated tools to register your address across hundreds of services in minutes. While your inbox fills up with welcome emails from charities and newsletters and random apps, a fraud alert from your bank gets buried in the pile. By the time you find it, if you find it, a window has already opened and closed.

Krebs described this tactic as early as 2012, with floods meant to keep businesses from noticing bank transfer alerts. In one 2020 case reported by WPXI, a woman's inbox flood hid a fraudulent $460 Target order set up for store pickup. Proofpoint describes bombing attacks as delivering over 1,500 emails an hour, though it doesn't give data behind the figure.

There's a follow-on risk too. Once the chaos starts, someone may reach out pretending to be from your bank or a tech support team, offering to help you deal with the flood. This isn't a coincidence. Microsoft Threat Intelligence documented attackers who flooded inboxes with sign-ups, then posed as IT support by phone or Teams to get victims to open Quick Assist and grant remote access. Its 2025 report says the same group claimed to be fixing the junk email problem it had caused.

Even without that follow-up social engineering step, the underlying risk to your account security is real. Your email address is the recovery option tied to nearly every account you own, your bank, your brokerage, your health insurance portal, your social media. Anyone who can reset a password through your inbox has a potential path into all of those accounts. That's why your email account is such a valuable target.

What to do right now

Start here before anything else.

1. Don't click anything in those emails. Not the unsubscribe link, not "confirm my account," not anything. Some of those links may be phishing attempts dressed up to look like routine confirmation buttons. Leave them alone for now and resist the urge to tidy up your inbox before you've checked for what matters.

2. Search your inbox for what's hiding. Before you delete a single email, search for keywords like "fraud," "order," "unauthorized," "password reset," "suspicious activity," and your bank's name. A subscription bombing attack is meant to bury something, a transaction alert, a password reset confirmation, a shipping notification for something you didn't buy. Make sure that something isn't already sitting in your inbox.

3. Check your financial accounts directly. Don't use links from any email, even ones that look legitimate. Open your bank's app or type the URL manually into your browser. Look for transactions you don't recognize, pending transfers, or changes to your account details. If you see anything suspicious, contact your bank through the number printed on the back of your card, not a number found in an email or a search result.

4. Secure your email account itself. Change your password immediately. Make it long, random, and something you don't use anywhere else. Then turn on two-factor authentication if you haven't already. With two-factor authentication enabled, even someone who has your password can't access your inbox without a second verification step, typically a code sent to your phone or generated by an authenticator app. Codes by text are better than nothing, an authenticator app is stronger, and a security key or passkey is strongest, according to the FTC.

5. Check whether your accounts were compromised. Use a service like Have I Been Pwned to see if your email address has appeared in any known data breaches. If it has, change the passwords for those accounts immediately, starting with anything financial or tied to your email recovery options. A breach from years ago can still be relevant if you haven't changed the password since.

6. Report and filter the noise. Once you've confirmed nothing important is buried, you can start managing the volume. Mark the unwanted emails as spam. Unsubscribing is generally fine for senders you recognize, ideally through your email provider's built-in button, but during a flood ESET advises against unsubscribing one by one, and the FTC suggests marking unwanted mail as spam and reporting it. Your email provider's spam filter will improve over time as you train it by marking messages correctly.

7. Reach out to services directly if needed. If someone has actually created an account using your address at a specific service, contact that company's support team. Most legitimate services will close an account when you explain the situation and confirm you didn't create it. Avoid resetting the password to take over an account you didn't create. Contact the service's support team or use its official process to report the account and request deletion.

When to take it more seriously

Most cases of email misuse are annoying but low-risk. Escalate your concern and act quickly if you notice any of these:

• A sudden flood of sign-up emails arriving within minutes of each other, rather than a trickle over days
• Financial alerts, order confirmations, or shipping notifications buried in the mix
• Someone reaches out (by email, phone, or any other channel) claiming to help you deal with the email problem
• Password reset emails you didn't request, especially for accounts you actively use
• Sign-in notifications from accounts you do own, indicating someone is attempting to access them

The first sign on that list is the key distinguishing factor. One or two stray confirmations arriving over a few days is almost always a typo or minor misuse, someone who fat-fingered their address on a sign-up form. Hundreds of emails arriving within a short window is a categorically different situation, and it warrants immediate action on your financial accounts before you worry about anything else. The inbox chaos is the distraction. Your bank account is the target.

How to stay ahead of it

You can't control whether someone types your address into a sign-up form, or whether an attacker decides to use subscription bombing as a cover tactic. What you can control is how exposed you are when it happens, and how quickly you can identify what's real.

Use a unique password for every account. If your email password is reused anywhere else, that reuse is the real vulnerability. A single breach at a low-stakes site can hand an attacker the keys to your inbox if the password matches. A password manager makes maintaining unique credentials manageable without requiring you to memorize dozens of complex strings.

Keep your recovery options up to date. Make sure your backup phone number and recovery email address are current and under your control. An old phone number that no longer belongs to you is a serious vulnerability, because whoever has that number now may be able to receive verification codes intended for you. A Princeton study found that recycled numbers can receive sensitive messages meant for previous owners, including login verification codes.

Stay on top of your inbox regularly. Not every hour, but consistently enough that you'd notice if something unusual started happening. A sudden shift in the volume or type of email you're receiving is a signal worth paying attention to. Familiarity with your normal inbox makes anomalies easier to spot.

Conclusion

Most unexpected sign-up emails turn out to be a typo or minor misuse. A sudden flood is different, and the calm response is the same every time: don't click anything, search your inbox for buried alerts, check your financial accounts directly, and secure your email account.

Guardio doesn't stop other people from typing your address into sign-up forms, but it covers related risks. Email Security flags phishing emails that get past the Gmail spam filter on your phone and computer, and Identity Breach Monitoring checks whether your email address or phone number shows up in a known data breach. Browsing protection on your computer and phone blocks phishing and scam sites before they open and explains why, and on iPhone, the Text Message Filter sends malicious texts to junk. No tool catches everything.

Get a free security scan with Guardio today and stay protected from phishing.