Fake Email Sign-Ups
Fake email sign-ups are not something I expected to write about on The Income Plug. But last month I opened my email list and found something that didn’t add up: a list I remembered at 4 contacts was suddenly sitting at 59.
If you’re a beginner blogger building an email list, you’re probably watching that subscriber number closely. I get it. It feels like proof that something is working. This post is about why that number can mislead you, what I found when I looked closer, what I’ve done so far, and what I haven’t fixed yet. I’m still working through it, and I’ll be clear about which parts are done and which aren’t.
What I Found When I Finally Checked My List
I hadn’t checked my Brevo list for about a month. That’s the first thing I’d do differently, and I’ll come back to it.
When I last looked, the list had 4 contacts. When I opened it this time, it showed 59.
My first reaction was a flash of excitement, I’ll admit. My second was a question: where did 55 new people come from? I hadn’t launched anything, run a promotion, or had a post suddenly take off. So instead of celebrating, I started checking.
Why the Numbers Didn't Match My Traffic
The first thing I did was compare the list against my traffic. I opened Google Search Console for the same period, and it showed 0 clicks.
Zero clicks from search doesn’t mean zero visitors from anywhere, so I’m not saying it proves anything on its own. But it was a big mismatch. A blog with no search clicks and 55 brand new subscribers in the same month is not a normal picture. If you’re not sure how to read those numbers, I wrote a beginner guide on how to read Google Search Console that covers the basics.
That mismatch was enough to make me stop trusting the raw count and look at the contacts themselves.
The Patterns That Made Me Suspect Fake Email Sign-Ups
I’m not going to share any real names or email addresses from my list. That’s other people’s data, and some of those addresses may belong to real people who never signed up for anything. So I’ll describe the patterns only.
The names didn’t match the addresses. Many first names had no connection to the email address next to them. A real person usually signs up with an address that at least loosely resembles their name or a nickname. These didn’t.
Some names repeated with different addresses. The same first name appeared several times, each with a different email address. Real people sometimes share a first name, but not like this.
Many of the first names looked unusual or generated. They looked more like random strings or oddly assembled words than names people actually have.
The timing gave it away. This was the clearest signal. About 30 contacts arrived on the same day, at almost the same time. Another group arrived together on a different day and time. Meanwhile, my real leads had arrived spread out over time, the way real sign-ups do. People find a blog at different moments. They don’t show up in batches of 30 within minutes.
After going through the list, I verified 10 contacts as real. I treated the other 49 as suspicious.
I want to be careful with that word. I’m calling them suspicious, not proven fake. I can’t see inside every contact’s situation. But the combination of mismatched names, repeats, odd-looking names, and clustered timing was strong enough that I stopped counting them as subscribers.
What Was Probably Behind These Fake Email Sign-Ups
My best explanation is bots. A bot is simply an automated program that finds forms on websites and fills them in without a human involved.
There’s a second possibility that fits what I saw, which is something called list bombing. That’s when someone uses automated tools to sign up real people’s email addresses to lots of forms at once. The goal is to flood a target’s inbox with confirmation emails and welcome messages, often to bury important emails (like a security alert or a payment notice) under a pile of junk. In that situation, my form was probably just one of many that got used, and I was a stepping stone rather than the target.
I need to be honest here: I can’t prove who did this or why. I’m presenting bots, and possibly list bombing, as the most likely explanation, not a certainty. I also don’t know whether this is common or rare for blogs like mine, so I’m not going to tell you that you’ll definitely face it. What I can tell you is what it looked like when it happened to me, so you’ll recognize the signs if it ever happens to you.
Why Fake Email Sign-Ups Matter, Even on a Small List
My first instinct was, “It’s only a few dozen contacts; how much damage can that do?” Quite a bit, as it turns out, and the reason isn’t obvious.
Every time you send an email, mailbox providers (the companies behind inboxes) quietly judge you. Your sender reputation is basically a trust score they build about you based on how people and addresses respond to your emails. Think of it like a credit score for email.
Fake email sign-ups can hurt that score in two main ways:
- Bounces. If you send to addresses that don’t exist, the emails bounce back. A lot of bounces tell mailbox providers you’re careless about who you email.
- Spam complaints. If a real person’s address was used to sign up without their knowledge and your email lands in their inbox, they may mark it as spam. Spam complaints are one of the strongest negative signals there is.
Both of those affect your deliverability, which is simply whether your emails actually reach inboxes or get routed to spam. Because I’m still small, a damaged reputation would follow me as I grow. Fixing a bad reputation is much harder than protecting a good one, and fake email sign-ups are one way to damage it without noticing.
There’s another reason to take it seriously. Brevo’s own help article on protecting forms warns that if a form is left unprotected and gets hit by a bot attack, the account can be suspended to protect the reputation of their shared sending IP and yours. I’ll link to that article below. I’m not saying that’s happening to me, but it shows why the platform itself cares.
What I've Done So Far
I want to be exact here, because it’s easy to overstate progress when you’re writing a post like this.
My sign-up form is built in Brevo. That’s the form the suspicious contacts came through, and it’s the one I’m protecting.
I turned on double opt-in. Double opt-in means a new contact has to click a link in a confirmation email before they’re counted as a subscriber. Someone types in an address, an email goes to that address, and only if the owner clicks the confirmation link does the contact become active. It’s one extra step for real subscribers, but it stops a lot of junk. A bot can submit a form, but it usually can’t open an inbox and click a link. And if a real person’s address was used without their knowledge, they simply won’t click, so they never become a subscriber.
Note that double opt-in is something I switched on after finding the problem. The suspicious contacts I found arrived before that. So I can’t tell you it has solved anything, because I haven’t had enough time to see how it performs.
I’m working on adding CAPTCHA, but it is not done yet. A CAPTCHA is one of those small puzzles or checkboxes that ask “are you a human?” before a form can be submitted, such as ticking a box or picking out certain images. It’s designed to block automated programs. Adding one to my Brevo form has not been easy for me. It needs some other setup first, and I haven’t finished it. Brevo has a help center with guidance on this, so rather than write a step-by-step guide that could be outdated by next month, I’d point you there. I’ll update this post when it’s done.
I haven’t finished cleaning the list. I’ve identified the 49 contacts I consider suspicious, but I haven’t finished removing them. I’m being careful about it for a reason I’ll explain in the lessons section.
The Problem I Haven't Solved Yet
While checking my list, I noticed something else that worried me more than the fake contacts did. My welcome email and free guide were not sending out.
I don’t know why.
I rechecked my setup, and everything looks intact. I’m not going to guess at a cause here, because I’d rather leave a gap than hand you a confident explanation I can’t back up. I also can’t say it’s connected to the fake sign-ups, and I can’t say it’s fixed, because it isn’t.
What I’m doing is going back through every part of the build, one piece at a time. The reason is simple: if my welcome email isn’t going out, real people who signed up for my free guide might be waiting for something that never arrived. Missing a real lead because I was busy chasing fake ones would be a poor trade. I’ve added an update section at the end of this post, and I’ll fill it in once I know what happened.
The Lessons I'm Taking From This
Here’s what I’d tell any beginner blogger, based on what happened to me.
1. Don't judge your list by the raw count
A bigger number feels good, but a number only means something if the people behind it are real. Ten real subscribers who open your emails are worth more than a hundred that don’t exist. The question to ask is not “how many?” but “how many are real, and how many are engaging?”
2. Check your list regularly, not once a month
A month was too long for me. If I’d looked sooner, I’d have caught the first batch earlier and had less to untangle. A quick weekly look is enough. You’re checking for sudden jumps, odd-looking names, and clusters of contacts arriving together.
3. Compare your list growth with your traffic
If your list suddenly jumps and your traffic hasn’t moved, ask why. Fake email sign-ups often show up as growth that doesn’t match visits. It’s one of the simplest checks there is, and it’s what started this whole investigation for me.
4. Test your own sign-up flow with a spare address
Use a spare email address that you control and sign up through your own form like a visitor would. Check that the confirmation email arrives, that the welcome email arrives, and that the free guide is delivered. I wish I’d been doing this regularly. It’s exactly the kind of test that would have caught my welcome email problem sooner.
5. Use double opt-in and CAPTCHA together
Neither stops every one of the fake email sign-ups alone. Double opt-in confirms that a real inbox is behind each address. CAPTCHA tries to stop bots from submitting the form in the first place. Brevo’s own help article recommends using a combination of protections instead of relying on one. I have one in place and one in progress, which is why I’m calling this a work in progress and not a success story.
6. Back up your list before deleting anything
This one matters. Before I delete a single contact, I’m exporting a copy of the full list. If I misjudge a contact, or if a real lead looks odd because they typed their name strangely, I can restore them. Deleting is permanent in most tools. A backup costs a minute and can save you from losing a real subscriber.
How to Check Your Own List for Fake Email Sign-Ups
You don’t need special tools to spot fake email sign-ups. Here’s the general approach I used, which should work in most email platforms:
- Look at when contacts were added. Sort by date added. Real sign-ups are spread out. Fake ones often arrive in tight clusters.
- Compare names to email addresses. Do they loosely match? Mismatches in large numbers are a flag.
- Look for repeated names with different addresses.
- Check whether the contacts engage. Real subscribers tend to open at least something. Contacts who never confirm or never engage deserve a second look.
- Compare list growth to your traffic. Use your analytics or Search Console and see whether the numbers make sense together.
Each email platform names its menus differently and changes them over time, so I won’t give click-by-click directions. If you use Brevo, the best place to start is Brevo’s help center. Their article on how to protect your forms from bots and spam sign-ups explains the options in plain language and will stay more current than anything I could write here.
If you’re still choosing an email platform, it’s worth checking what spam protection each one offers before you commit. I’ve written comparisons of MailerLite vs Systeme.io and ConvertKit vs MailerLite that cover the bigger picture.
Disclosure: I’m a Systeme.io affiliate, which means I may earn a commission if you sign up through my link. It doesn’t change what I write.
I’m currently using Brevo for this list. A full review is coming, and I’ll link it here once it’s live: [LINK: Brevo Review for Bloggers, add once published].
For more on how I track the numbers behind this blog, you can read my Month 10 blogging report.
Frequently Asked Questions About Fake Email Sign-Ups
What are fake email sign-ups?
Fake email sign-ups are subscriptions to your list that don’t come from a real person who wants your emails. They can come from automated bots, from someone using made-up addresses, or from someone signing up other people’s real addresses without their knowledge. In all cases, the “subscriber” isn’t a genuine reader.
How can I tell if my list has fake email sign-ups?
Look for patterns instead of single contacts. In my case, the signs were names that didn’t match the email addresses, repeated names with different addresses, unusual or generated-looking names, and large groups of contacts arriving at almost the same time. A jump in subscribers that doesn’t match your traffic is another good clue.
What is list bombing?
List bombing is when someone signs up real people’s email addresses to many forms at once, so those people’s inboxes fill up with confirmation and welcome emails. It’s often done to bury important messages in the flood. Your form can be one of many used in this way, even though you’re not the target. I can’t prove this is what happened on my list, but it fits what I saw.
Can fake email sign-ups hurt my email deliverability?
Yes, they can. Emails sent to addresses that don’t exist bounce, and emails sent to real people who never signed up can be marked as spam. Both hurt your sender reputation, which is the trust score mailbox providers build about you. That can push your emails toward the spam folder, even on a small list.
Does double opt-in stop fake email sign-ups?
It helps a lot, but I wouldn’t call it a complete fix. Double opt-in makes each new contact click a confirmation link before they’re counted, which filters out many bots and addresses used without the owner’s knowledge. It works best alongside other protection, such as CAPTCHA. I turned it on recently, so I can’t yet say how well it’s working for me.
Should I delete suspicious contacts straight away?
I wouldn’t. Back up your full list first by exporting it, then review the suspicious contacts carefully. Once you delete a contact, you may not be able to get it back, and a real lead can occasionally look odd. A backup protects you from removing someone genuine.
Conclusion
Fake email sign-ups taught me something I should have known already: a subscriber count is only a number, and it’s only useful if the people behind it are real. My list went from 4 contacts to 59 in about a month, with no matching traffic. When I looked closer, I found names that didn’t fit the addresses, repeated names, odd-looking names, and big groups of contacts arriving at the same moment. I verified 10 as real and treated the other 49 as suspicious. My best explanation is bots, possibly list bombing, but I can’t prove it.
I’ve turned on double opt-in so new contacts must confirm before they count. I’m working on a CAPTCHA, which isn’t finished. I haven’t finished cleaning the list, and I’m backing it up before I delete anything. I also have a separate unresolved problem: my welcome email and free guide weren’t sending, and I don’t yet know why.
If you take one thing from this, make it this: check your list regularly instead of once a month, compare growth against your traffic, test your own sign-up flow with a spare address, and protect your form before you need to. Fake sign-ups can damage your sender reputation through bounces and spam complaints, even when your list is small. I’m still working through this myself, and I’d rather show you the honest, unfinished version than pretend I’ve got it all figured out.
