Why Finance and Payroll Teams Are the Primary Target of Email Bomb Attacks

The registration bomb does not arrive while your inbox is quiet. It arrives on a Tuesday morning, during business hours, while the finance team is processing invoices. Two hundred emails per minute from every corner of the internet. Somewhere in the flood is a payment confirmation or a password reset. That is the one the attacker is waiting for you to miss.

Why finance teams specifically

Finance and payroll teams sit at the intersection of email and money. They authorise payments, receive invoices, process payroll instructions, and communicate with banks. Every one of those actions is triggered or confirmed by email. An attacker who can disrupt that inbox, even for a few hours, creates a window in which a fraudulent instruction can be sent, a payment redirected, or a supplier's bank details changed without the change being noticed in time. The email bomb is not aimed at the inbox. It is aimed at the workflow that depends on it.

The flood as cover

Registration bomb attacks work by submitting a target email address to thousands of online signup forms simultaneously. Each service sends a confirmation email. None of those emails are spam in any conventional sense. They are legitimate messages from real organisations. The attack pattern is only visible in aggregate, which is why conventional spam filters pass every single one. A finance team member who opens their inbox to find three hundred new emails does not immediately think fraud. They think something has gone wrong with their email. They start deleting. They start filtering. Meanwhile, somewhere in the flood, a notification has arrived that they needed to act on.

What happens during the window

The timing is deliberate. Registration bomb attacks targeting finance teams almost always happen during business hours, when payments are being processed and decisions are being made. The attacker uses that window to initiate a fraudulent bank transfer while the confirmation email is buried, send a request to change supplier payment details while the finance team is occupied, trigger a password reset on a financial platform and act on it before the reset email surfaces, or impersonate an executive requesting an urgent transfer while the real executive cannot be reached. The flood does not have to last long. An hour is often enough.

Why existing tools do not catch it

Standard spam filters evaluate individual emails. A confirmation email from a real company is not spam. A welcome message from a real newsletter is not spam. Three hundred of them arriving in forty minutes from three hundred different senders is an attack, but recognising that pattern requires a view across the entire inbox simultaneously. Finance teams often have additional protection layered on top: Microsoft Defender, Google Workspace security features, third-party filters. None of these are built to detect registration bomb patterns. The attack is specifically designed to look like normal mail at the individual message level, which is exactly where those tools look.

What the defence actually looks like

The only effective defence operates upstream, before mail reaches the inbox. A gateway sitting in front of the mail provider sees the full picture: the volume of first-time senders, the rate of arrival, the ASN distribution of the incoming flood. When a burst pattern consistent with a registration bomb triggers, the flood is held before delivery. The finance team's inbox stays clear. The payment confirmation or the password reset that the attacker was counting on getting lost arrives normally, is seen, and is acted on. The window the attack was designed to create never opens.

Frequently Asked Questions

Should we give finance teams a separate unlisted email address for sensitive communications?

It helps reduce the attack surface, but it is not a complete solution. Finance teams receive invoices and supplier communications from external parties, which means at least some addresses have to be reachable from outside the organisation. A gateway that sits in front of all inbound mail is more robust than trying to keep specific addresses secret, because it protects every address regardless of how exposed it is.

How quickly does an attacker typically act during a flood?

In documented cases, the window between the flood starting and the fraudulent action is often under two hours. The attack is timed to create maximum confusion during normal business hours. Attackers either have a collaborator ready to act the moment the flood starts, or have already staged the fraudulent instruction in advance and are waiting for the confirmation to get lost in the noise.

Does cyber insurance cover losses from this type of attack?

It depends on the policy. Social engineering and business email compromise losses are covered by some cyber policies and excluded by others. Losses that result from an employee acting on a fraudulent instruction during an attack are often treated differently from direct system breaches. Review your policy specifically for business email compromise and social engineering coverage. If it is absent, it is worth addressing before an incident, not after.