The oldest trick in the book
Distraction is a fundamental technique in fraud. A pickpocket works in a crowd. A con artist creates urgency. And a modern email fraudster buries your inbox under hundreds of thousands of emails, then makes a move while you're drowning in noise. Registration bomb attacks are almost never the primary crime. They're the cover.
What the attacker is actually doing
While your inbox is paralysed, the attacker is doing one of a few things. In financial fraud cases, the most common scenario is a fraudulent bank transfer. The attacker has already compromised your account or is posing as a supplier. When they initiate a transfer, the confirmation email lands somewhere in the flood. It never gets read. The transfer goes through. By the time you find the email, the money is long gone.
Account takeover follows the same pattern
The flood is also used to hide password reset emails. If an attacker has access to your email address, they can trigger resets on high-value accounts (banking, payroll, e-commerce) and the reset confirmation gets buried in the noise. You never see it. The attacker does. By the time your inbox is clear, the accounts are already theirs.
Why the timing isn't accidental
Registration bomb attacks don't happen at 3am. They happen during business hours, when staff are actively using email and most likely to be overwhelmed rather than suspicious. The attacker wants chaos, not silence. A person buried under thousands of emails is far more likely to miss a critical one than a person who sees nothing at all.
The defence that actually works
Because the attack is designed to overwhelm a human, the defence has to be automated. MX Moat detects the burst pattern at the network level and quarantines the flood before it reaches your inbox, typically within 3-5 minutes of the attack starting. That window is the difference between catching the fraud in time and not.