The [email protected] SEO Job Scam

If a “Canva Careers” or “Booking.com” recruiter emails you a Senior SEO Manager role from [email protected], close the tab. That is not their careers team. That is a scammer using Tally forms as a free outbound mail relay, and the SEO industry is one of the target lists precisely because SEO roles pay well and SEO people read every recruiter mail that lands.

Here is the one that landed in my inbox this month:

Subject: “Interesting opportunity for your skills”. Claim: a Senior SEO Manager role at Canva. Send domain: [email protected]. I never applied to Canva. The domain does not belong to Canva. The SEO offer is fake, and the same template is doing the rounds pretending to be Booking.com “AI SEO Focused” Digital Marketing Manager roles, “hrstaffingworx” on Gmail, and a fictional “Innovatecloud Solutions” that asked one target for ₹1,550 up front.

Why the sender is [email protected]

Tally is a form builder. It has a workflow feature that fires an automated email when a submission lands, and it sends those notifications from a shared address: [email protected]. That address is real. It authenticates cleanly through Tally’s SPF and DKIM. It sails into the inbox because Tally itself is a legitimate, high domain rating sender that hundreds of thousands of forms rely on.

A scammer who wants to run a phishing wave does not need to buy a domain, warm it up, and beg Google to trust it. They need a Tally account. They build a form nobody will ever fill in, wire an automated notification with the phishing body, and trigger it by submitting the form themselves once per target. The address in the “From” field is Tally’s. The deliverability is Tally’s. The reputation being burned is Tally’s, not theirs.

That is the whole mechanism. Everything else is decoration.

Why the spam filter misses it

Gmail’s classifier does two things this abuse cleanly defeats. It checks whether the sending domain authenticates. It weighs the sender’s reputation. tally.so passes both. There is no forged header to detect. There is no burner domain to blacklist. The email is a real Tally notification with a hostile body, and the classifier has no signal that separates it from the honest form notifications Tally sends every hour.

The “From” name reads “Canva Careers” or “Booking Recruiter” because the scammer sets that string on the form. Tally does not verify the display name against anything. Every field the eye lands on first is the field the sender fully controls.

The five signals that give it away

Read these in order. Any two together, delete the mail.

1. The domain in the “From” address is tally.so, a free provider like gmail.com, or a lookalike. A Canva recruiter mails from @canva.com. A Booking.com recruiter mails from @booking.com. The domain is the one sender field a scammer cannot forge, which is exactly where the tell lives.
2. You never applied. Real inbound recruiting almost always starts on LinkedIn where the recruiter can prove they read your profile. It does not start with a cold “your professional background caught our attention” note from a generic notifications inbox.
3. The SEO role is vague and flattering. “Senior SEO Manager.” “Digital Marketing Manager (AI SEO Focused).” No team, no manager name, no location, no salary band, no link to the listing. The one I got even had “It’s an Senior SEO Manager opportunity” in the body: a company that pays six figures for an SEO lead does not send outbound mail with that sentence in it.
4. The next step is a phone call, a WhatsApp thread, or a Google Form. A real hiring process runs through an ATS with a corporate URL: careers.canva.com, jobs.lever.co/canva, boards.greenhouse.io/booking. Nothing legitimate collects your details on a Tally form or moves you to WhatsApp on the first message.
5. Money comes up before the interview. Registration fee. Background check fee. Training kit. Equipment deposit. This is where the scam monetises. If a currency figure appears before you have spoken to a human, the offer is not real.

What to do when one lands

Report the sender to Tally at [email protected] with the full message headers. Tally cannot police the outbound stream in real time, but they do disable accounts they get reports about, and the account behind that specific “Canva Careers” address is worth ending. Then mark the mail as phishing in Gmail, not spam. Phishing feeds a different classifier and it is what teaches the filter to catch the next one.

Do not reply to say “you have the wrong person”. A reply confirms the address is monitored and moves you to the next round.

The Tally-as-relay pattern is not going away on its own, because from Tally’s side each individual send looks like a normal customer using a normal feature. The only defence right now is the send domain. Check it every time. If a recruiter’s “From” line does not end in the employer’s own domain, the offer is not from the employer, and the rest of the SEO email hygiene stack does not save you from clicking on it.