Is This Job Application Email Real? How to Check

You applied to a company, and the reply came from no-reply@ashbyhq.com, an address with no company name in it. Most of the time that’s normal. Employers run hiring through an applicant tracking system (ATS), and the ATS sends a lot of the mail. An unfamiliar sender still takes only a few minutes to check.

Is this job application email real?

Probably, if it names a company and role you applied to, comes from a sender that fits the table below, and asks for nothing unusual. You can settle it by going to the employer’s careers site yourself and confirming the role or your application there. Don’t use the link in the email for this check.

Why the email comes from the ATS and not the company

Automated hiring mail such as confirmations, scheduling requests and forms is often sent by the ATS on the employer’s behalf. Ashby, for example, lets the employer set the display name but sends from its own no-reply@ashbyhq.com address. Mail that a recruiter writes can look different, since many systems let it go out under the recruiter’s or company’s address. Greenhouse says a verified employer’s email appears to candidates as coming from the organization’s domain.

So one application can produce mail from two senders, and that alone doesn’t mean anything is wrong.

Which sender to expect from each ATS

This list isn’t complete, because employers can configure their own senders. The employer’s own statement beats this table: D2L, for example, says all its recruiting mail comes from a D2L.com address. Search the company’s name with “recruitment fraud” to see whether it publishes a list, as Citi does.

How to check whether an ATS email is genuine

A sender domain tells you which software the mail claims to come from. It doesn’t tell you who is behind the message. Greenhouse and SmartRecruiters have both posted warnings about people posing as their own recruiters, and the FBI says scammers copy real postings and change the contact details. These checks cover that gap:

1. Ask whether you applied. The Canadian Anti-Fraud Centre lists an offer for a job you never applied to as a warning sign. Recruiters do contact people who haven’t applied, so an unexpected first message isn’t proof of fraud, but an unexpected offer is a bad sign. Search your inbox and your own records for the company.
2. Read the whole address on a computer. UBC warns that phones and tablets often hide the sender address, and it gives @workday.svc.u-bc.ca as a fake of its real @workday.svc.ubc.ca. One added hyphen is easy to miss. Gmail can also show “Mailed by” and “Signed by” in a message’s details, and it warns you with a question mark next to the sender if the message isn’t authenticated.
3. Go to the employer’s site yourself. Type or search for the company’s address, open its careers page and find the role. The FTC’s advice on suspicious messages is to use a phone number or website you know is real, and it warns that links and attachments can install malware.
4. Sign in or ask from there. What you can do next depends on the system, as the list below shows.

• Workday: sign in to Candidate Home from the employer’s careers site. Accounts are per employer (see Workday statuses).
• iCIMS and SmartRecruiters: use the portal login from the employer’s careers page (see iCIMS and SmartRecruiters).
• Greenhouse: MyGreenhouse is at my.greenhouse.com if you have an account (see Greenhouse statuses). For questions about an application, Greenhouse tells candidates to contact the employer.
• Ashby and Lever: there’s no candidate login, so confirm the posting is listed and contact the company using details from its own site. The Ashby and Lever guides list the emails you’ll normally get from each.

Genuine mail can also look wrong. Brown University’s IT team posted a real Workday job email that had been flagged because its urgent wording resembled phony job offers, so a warning label on its own doesn’t settle the question either.

Red flags that point to a recruitment scam

These don’t depend on the sender, so they apply even when the address looks right:

• Asking for payment. The FTC’s rule is “Never pay to get paid or get a job.” That includes training, starter kits and certifications.
• Gift cards or a cheque to deposit. The FTC says no honest employer will send you a cheque to deposit and then ask you to forward part of it or buy gift cards.
• Moving you to Telegram or WhatsApp. The FTC tells people to ignore generic, unexpected job messages on these apps. Employers including D2L and LLNL say they don’t recruit through instant messaging.
• Early bank, card or ID details. The FBI says never to give an employer credit card information, or bank details before verifying who they are. Citi says it asks for sensitive details only after a formal written offer, through secure onboarding.
• A lookalike or free email domain. Yaskawa describes senders using Gmail, Yahoo, Outlook or a misspelled company domain.
• Pressure with no details. Urgent wording plus no job description or link to a posting you can verify on the company’s site.

For the full list, including ghost jobs and resume harvesting, see how to spot fake job postings.

What to do if the email is fake

1. Stop replying and don’t open anything else. Keep the email, sender details and any screenshots for your report.
2. If you sent money, call whoever moved it right away. That might be your bank, a gift card company or a wire service. If you shared a password or ID, follow the recovery steps in the fake postings guide.
3. Report it where you live. In the US, use ReportFraud.ftc.gov and the FBI’s IC3, and you can tell your state attorney general. In Canada, report to your local police and the Canadian Anti-Fraud Centre at 1-888-495-8501 or online through its report site.
4. Forward the phishing email. The FTC says to send it to the Anti-Phishing Working Group at reportphishing@apwg.org.
5. Tell the employer being impersonated. Some publish a contact for this, such as Citi’s spoof@citi.com. Find the address on the company’s own site.