Your signup form is being used to bury credit card fraud

Katherine Wood, a content lead at the fraud-prevention firm Signifyd, woke on a Sunday morning in 2024 to find several hundred unread messages in an inbox she describes as a tidy, tranquil place. They were in English, Chinese, Japanese, Russian and Polish. They thanked her for creating accounts on sites she had never visited and for signing up to newsletters she had never requested.

Buried somewhere in that flood was a receipt from the Apple Store for about $1,300.

By the time Wood found it, checked her card and phoned her bank, the order had already been collected in person from an Apple store in her city by a man recorded as "John W." Over the following three days she received more than 50,000 emails. She is still getting the occasional one.

Every one of those messages was generated by a signup form on somebody's website. Perhaps a few hundred of them. The forms were not hacked, and the companies that own them did nothing wrong beyond leaving a form open. If you run a Shopify store with an unprotected newsletter box in the footer, there is a reasonable chance one of them was yours.

A Sunday morning in February

The technique has a name in the security literature. Researchers call it subscription bombing, and in a paper presented in April 2026, published in Communications of the ACM, a team led by EPFL's Mathias Payer analysed 24 real campaigns comprising 46,970 unwanted emails.

Their description of the mechanism is worth quoting in full, because it explains why the attack is so hard to stop at the receiving end:

"The attacker registers the victim's email address with thousands of third-party online services, which act as amplifiers that flood the target's inbox with legitimate subscription confirmations and notification messages. Such emails are much harder to block automatically by the receiving email server."

Payer et al., Subscription Bombing: Email under Attack, Communications of the ACM, April 2026

The word doing the work in that paragraph is amplifiers. The attacker sends nothing. Your store sends it, from your domain, with your SPF and DKIM records correctly configured, which is precisely why it lands.

The purpose is rarely harassment. Proofpoint, which published research on the technique in December 2025, measured bursts of more than 1,500 emails an hour and described the flood as cover: the victim is kept busy deleting while a single critical message, a password-change alert or a transaction confirmation, scrolls past unread.

Swiss authorities reached the same conclusion. In a bulletin dated 10 February 2026, the country's National Cyber Security Centre reported a rise in cases and stated plainly that "the aim of this attack is not harassment," but to conceal a single message, typically a security alert from a bank or an online shop where the attacker has already triggered a transaction.

The technique has also been adopted further up the criminal food chain. Proofpoint, citing research by Hornetsecurity, reported that the Black Basta ransomware group has weaponised subscription bombing directly: flood the target's inbox, then make contact over Microsoft Teams posing as IT support offering to fix the spam problem, and use that pretext to talk the victim into installing a remote access tool.

The trade in inbox noise

Subscription bombing is sold as a service. The EPFL researchers documented dark web listings for it, and noted that the technical bar is low: "some groups simply record the POST requests required to sign up for newsletters and then replay it with the new target address."

That sentence is the one for merchants to sit with. The attacker does not need to load your store, look at your theme, or interact with your form. They need the POST request once. After that your form is a line in a list, replayed against whichever address has been bought that week.

The researchers noted one obstacle to the replay approach, and it is the reason this article exists: "This is not always trivial, as many websites use CAPTCHAs or cross site request forgery" protections. A form with a working check on it is not worth the effort when there are thousands without one.

The same forms get used for other things. In April 2026, Cybernews collected reports from site operators who had found their own forms conscripted. One described an attacker using a "change credit card" form to validate a list of stolen cards overnight, rotating IP addresses on every request and starting at midnight when nobody was watching. Roughly 2,000 cards were tested and about ten percent came back valid, each confirmed with a $1 charge and refund. The operator had Cloudflare Turnstile installed on the form at the time, running on its invisible setting.

A second operator, running a newsletter company, described dealing with the problem for over a decade precisely because they do double opt-in, and so send a confirmation email to every address submitted.

None of these people were the target. All of them supplied the ammunition.

What it does to the store

So much for the stranger whose inbox is being buried. The second-order effect lands on the merchant, and it is the reason this is a business problem rather than a moral one.

Klaviyo, whose customers include a large share of Shopify's email volume, documents the same attack from the merchant's side and calls it list bombing: "a malicious attack where the attacker exploits a signup form or checkout page by making a large number of fake submissions, filling the associated list with emails and phone numbers that have not consented or are invalid."

That definition contains two populations, and merchants tend to picture only one of them. The invalid addresses, bot4471@tempmail.io and random strings at dead domains, hard-bounce. That is ugly but legible.

The real addresses are the expensive ones. Klaviyo is explicit that "bots can fill out forms with real email addresses, and profiles of people who have no knowledge of this are being added to marketing lists." Those are working inboxes belonging to people who have never heard of the store. The welcome flow fires. Some fraction of them do not unsubscribe. They press report spam, and that press is recorded against the sending domain.

On Shopify the traffic arrives through two doors. Klaviyo names the footer newsletter form specifically, on the grounds that a form collecting an email address and nothing else is the cheapest thing on the internet to automate. The second is abandoned checkout: a bot starts a checkout with a real person's address, abandons it, and the event syncs into the email platform as a profile, at which point the abandoned-cart flow mails a stranger.

Which is why, when merchants report a checkout bot wave, the standing advice is to switch off abandoned-checkout emails. The point is not to save the emails. It is to stop the store's own automation from participating.

What follows is the mechanism, and the reason it outlives the attack that started it.

The arithmetic of a poisoned list

"Bad for deliverability" is not an actionable statement. The useful questions are where the thresholds sit, who enforces them, and how few injected subscribers it takes to cross one.

The number is public. Google's sender guidelines require bulk senders, defined as anyone sending more than 5,000 messages a day to Gmail addresses, to keep their spam complaint rate below 0.3% and to aim below 0.1%. A 10,000-person list clears the bulk-sender threshold on any campaign day. Google states that rates at or above 0.3% "will result in dramatic negative impacts on email delivery." Yahoo publishes the same figure.

Three complaints per thousand is the wall. One per thousand is where you want to live. And if you send fewer than 5,000 a day to Gmail, the formal requirement does not bind the sender. The reputation system underneath it still does.

So: model it. Below is a 10,000-subscriber Shopify list, healthy at baseline, with fake profiles injected at four scales. The assumptions are stated below the table. They are estimates rather than measurements, and the section beneath shows exactly how hard they are working.

Two consequences follow from those numbers.

The complaint rate does the lasting damage. Bounces are ugly, and a send at fourteen percent hard bounces is an emergency in its own right; the sending platform will usually act on it before Gmail does. But bounces end when the addresses are suppressed. Complaints do not get cleaned up. They feed a rolling reputation score that only weeks of clean sending will work off. This is why the real addresses in a bombed cohort cost more than the fake ones, despite being fewer.

Injected profiles also appear on the invoice. Klaviyo prices on active profiles, and most competitors price similarly. Two thousand five hundred phantom subscribers are billable every month until they are dealt with, and they generate nothing. Suppressing them, which is the correct move for deliverability in any case, also removes them from the bill.

Anatomy of a bombed signup

In a list view, injected profiles are indistinguishable from real ones. In a profile view they are not. Below is a composite record assembled from the pattern, with the diagnostic fields marked.

Triage and clean-up

The order matters more than any individual step here. Several of these make things worse if run out of sequence.

1. Pause every automated flow that mails new profiles. Welcome series, abandoned checkout, browse abandonment. Do this before anything else. While the investigation proceeds, those flows are mailing the attack on the store's behalf.
2. Sort profiles by creation timestamp and identify the injected window. Note the start and end times precisely.
3. Suppress the cohort. Do not delete it. Deleted profiles can be re-imported, or simply re-submitted by the same bots the following night. Suppressed addresses cannot be mailed again in either case. Deletion feels tidier and is worse.
4. Do not send a re-permission campaign. See the advisory above. If you genuinely cannot distinguish real signups from injected ones in the window, mail only those with a recorded session or a purchase.
5. Resume sending to the engaged segment only, meaning 30- or 60-day openers, for two to three weeks. Reputation is rebuilt by the ratio rather than the count. A smaller send with high engagement and near-zero complaints restores standing faster than a full-list send does. The reason to send less is not that volume caused the damage. It is that every message to an unengaged address is another opportunity to be wrong while the domain has no credit.
6. Watch your complaint rate weekly, in Google Postmaster Tools. This is the instrument the problem has been hiding from. It is free, it reports the actual Gmail-measured spam rate and domain reputation against the 0.3% line, and it takes about ten minutes to set up with a DNS record. Set it up before it is needed. Recovery is measured in weeks, and judging it from the next campaign leads merchants to change three things at once.
7. Then, and only then, resume normal sending volume.

Shutting the doors

The clean-up costs two to three weeks of suppressed sending volume, at whatever the list is worth per week. It works. It works less well the second time, because each recovery starts from a lower base. The durable work is at the form.

Shopify's built-in protection does cover the newsletter form, with one constraint: the storefront CAPTCHA setting groups contact, newsletter and blog comments under a single checkbox. There is no way to protect one and leave another frictionless. As covered in our first dispatch, that setting also fails silently in four specific circumstances, none of which the Shopify admin reports.

What actually holds, in rough order of effort:

• Accept that checkout is a different problem. You cannot put a CAPTCHA in Shopify checkout, and you should not want to. The controls that exist there are Shopify's own bot protection, rate limiting at the edge, and most usefully a delay on the abandoned-checkout flow. A flow that waits four hours rather than thirty minutes leaves time to spot a wave before the store's own automation mails it to strangers. It costs a little recovered revenue and removes the largest exposure at the door that cannot be gated.
• Score the newsletter form invisibly. Risk scoring on submission catches automation without asking the customer to prove anything, which matters more here than on a contact form. A newsletter signup is a two-second impulse and visible friction kills it outright.
• Add a honeypot to it. A hidden field that a person never sees and a naive script always fills. Close to free, and it catches exactly the direct-POST traffic that skips your storefront entirely.
• Turn on double opt-in, subject to the caveats above.
• Ask for one more field. First name, or country. It raises the cost per submission slightly and defeats the cheapest replay scripts, which record a single POST and repeat it. Test the conversion impact before keeping it.
• Alert on velocity. Whatever the tool, configure a notification when signups exceed a multiple of the normal hourly rate. Proofpoint measured bombing bursts above 1,500 emails an hour. Catching one at hour two rather than day four is the difference between an afternoon and a month.

One scoping note. Klaviyo's definition covers phone numbers as well as email addresses, and SMS bombing is a separate and considerably worse problem, because carrier complaint thresholds are stricter and enforcement is blunter. It deserves its own dispatch rather than a paragraph here.

None of the above is exotic. It is ordinary hygiene for a form on the public internet. The reason so few Shopify stores bother is that the failure mode is invisible right up until the quarter it is not.

The merchants whose forms flooded Katherine Wood's inbox never found out that they had. Most of them still do not know. That is the ordinary condition of this attack: the store is neither the target nor the victim, only the instrument, and the only party positioned to take the instrument away is the store.