How to stop a spam bomb in Gmail with filters

If several hundred welcome emails, newsletter signups, and “confirm your subscription” messages have landed in your Gmail in the space of an hour, you’re being email bombed. Someone has run your address through thousands of signup forms at once.

Gmail’s spam filter won’t save you, because none of it is technically spam. Your address really was typed into those signup forms. So a welcome email from a real company looks exactly like one you asked for.

You can’t unsubscribe your way out either. But you can quarantine the whole flood with one Gmail filter in about five minutes. You’ll get your inbox back and lose nothing.

Here’s how, and the thing to do before you touch a filter.

First, find the email the bomb is hiding

A subscription bomb is nearly always a smokescreen. Somewhere under those thousands of emails is one the attacker doesn’t want you to read. It might be an order confirmation from a shop where they’ve used your card, a password reset, a new sign-in alert, or a payment notification. The flood is there so you’ll mass-delete without looking.

So before you filter, archive, or delete anything, go looking for it. Paste these into the Gmail search box:

• in:anywhere newer_than:3d from:(paypal.com OR amazon.com OR apple.com). Add your bank, card provider, and anywhere else you have a card saved.
• in:anywhere newer_than:3d subject:(order OR receipt OR invoice OR password OR "sign-in" OR verify)

in:anywhere matters. It searches Spam and Trash too, which is exactly where the email you need may have ended up.

Then check three more things:

1. Your Google account. Run the Security Checkup, change your password, turn on two-factor authentication or a passkey, and sign out of any device you don’t recognise.
2. Your existing Gmail filters and forwarding. Settings → Filters and Blocked Addresses, and Settings → Forwarding and POP/IMAP. If there’s a rule you didn’t create, especially one that deletes or forwards mail from your bank, someone already has access to your account. That’s the emergency, not the newsletters.
3. The accounts themselves. Open your bank and shopping accounts directly and check the order and activity history. Don’t trust your inbox for this right now.

If you find a real purchase or a changed password, call the company now. The inbox can wait.

Why unsubscribing and “Report spam” won’t get you out

Unsubscribing is the obvious move and the wrong one at this scale. There can be thousands of lists. Most of them are legitimate companies whose signup forms were abused, not spammers.

Report spam works per sender. You’d be reporting thousands of real companies one at a time, which hurts them and won’t slow the flood down. Worse, Gmail empties Spam after 30 days, and Spam is a likely hiding place for the one email you’re trying to find.

Block sender is the same problem: one address at a time, against a list that keeps growing.

What works: quarantine everything except people you know

The instinct is to write a filter that catches the bomb. But that’s backwards. The bomb arrives from thousands of senders you’ve never heard of, with no shared pattern to match on.

Flip it around. Let through the handful of senders you can’t miss, and quarantine everything else into a label. Nothing gets deleted. It also works on lists that sign you up tomorrow, not just the ones that already have.

1. Open Gmail on a desktop browser (the mobile app can’t create filters, though it obeys them once they exist).

2. Click the Search Mail field at the top of the page

3. Paste a list of the senders and domains you can’t afford to miss, with a minus sign in front:

   -from:(yourbank.com OR yourwork.com OR mum@example.com OR school.org)

   Domains catch every address at that domain, so favour those over individual addresses.

4. Click the filter icon on the right

   

5. Ignore the options in this popup and click “Create filter” at the bottom, then tick:

   • Skip the Inbox (Archive it)
   • Apply the label → New label → call it Bomb

6. Do not tick “Delete it.” The email you’re looking for is somewhere in that pile.

7. Optionally tick Also apply filter to matching conversations to sweep everything that’s already landed into the label in one go.

   

Your inbox should now just be the people on your list. Everything else is sitting quietly under the Bomb label, out of the way but intact.

The catch is that a genuine receipt from a shop you’ve never emailed before goes to Bomb too. That’s why the check at the top of this article comes first. Open the label once a day and skim it, then delete the filter once the flood has died down.

A softer version, if a whitelist feels too blunt

Filter on the language every signup confirmation uses instead. Same steps, but put this in Has the words:

subject:("confirm your subscription" OR "confirm your email" OR "verify your email" OR "confirm your signup" OR "subscription confirmed" OR "thanks for subscribing" OR "welcome to")

This catches most of the first wave without hiding anything sent by a human. It will miss the plain newsletters that start arriving once the confirmations stop. So it’s the gentler option, not the thorough one.

Make the rest of the day survivable

• Switch Settings → Inbox → Inbox type to Important first or Priority first, so Gmail floats mail from people you actually correspond with above whatever leaks through.

  
  

• Turn off mail notifications on your phone for a few days. Half the damage of a bomb is the pinging.

• Don’t reply to anything in the flood, and don’t click unsubscribe links in emails that look like phishing rather than a real company’s newsletter.

• If something urgent is in flight, like a house move, a contract, or a payment, ask the other side to call or text you instead of emailing for the next few days.

How long does it last?

The heaviest part is usually the first 24 to 72 hours. It then tapers over a week or two as lists drop an address that never confirmed its subscription. Lists that use double opt-in give up quickly. The ones that don’t will keep sending for a while, which is why a filter beats a cleanup you have to repeat every morning.

When it’s over

Now the clean up can start. Delete the filter that you created above (you can find filters here), then deal with what’s under the label.

Some emails will still be coming in, as you will likely have been added to a lot of new mailing lists. Our Unsubscriber can help with this, as you can see each mailing list by sender and unsubscribe easily and in bulk.

The short version

A spam bomb feels like a disaster. It’s actually a five-minute fix and a lot of patience. Here’s the whole plan:

1. Look for the hidden email first. Search Spam and Trash, run the Google Security Checkup, and open your bank and shopping accounts directly.
2. Don’t delete, report, or unsubscribe. Quarantine instead, so nothing you need is lost.
3. Whitelist the people you can’t miss and label everything else. Skim the label once a day.
4. Clean up when it’s over. Bulk unsubscribe with Unsubscriber, or let Spam Blocker catch the next one before it starts.

The newsletters are the noise. The email underneath them is the reason someone did this. Find it first, and everything else is just tidying up.