Job Offer from no-reply@appsheet.com? The Sender Is Real. The Employer Isn't Proven.
If a job offer or interview invitation arrived in your inbox from no-reply@appsheet.com, your suspicion is well placed — and so is your confusion, because this one is engineered to survive the checks that catch other scams. The email really did pass through Google's systems. It will pass the technical tests your mail app runs, because Google genuinely sent it. What that proves is only this: someone used a Google platform to send you a message. It says nothing whatsoever about a job, an employer, or the person hiding behind the app.
What AppSheet actually is
AppSheet is Google's no-code app-building platform. Anyone with a Google account can build a small app on it — a form, a tracker, an intake tool — and that app can send automated emails to people. Those emails go out from the platform's shared address: no-reply@appsheet.com. Businesses use it legitimately for internal tools and notifications. Scammers use it for the same reason they use every legitimate platform: the infrastructure is real, the sender verifies, the message lands in your inbox instead of your spam folder, and the Google association does the trust-building for them.
This is the crucial distinction the whole page turns on: the sender address belongs to the platform, not to the employer. An offer from a company's own domain tells you the company's own systems sent it. An offer from appsheet.com tells you an app sent it — an app that literally anyone could have built in an afternoon, under any name they typed into it.
How the AppSheet job offer runs
The approach usually looks polished. An email arrives announcing an interview invitation, an offer, or an application step for a job at a real, recognizable company — often one you actually applied to somewhere, which is what makes it land. Inside is a professional-looking message and a link: to "confirm your interview," complete an "onboarding form," view your "offer letter," or download a document. That link is the payload. It leads to a form that harvests your personal information — name, address, date of birth, sometimes SSN and banking details "for payroll" — or to pages and files built to continue the impersonation off-platform, often ending in a chat-app interview, a fee, or a fake check, like the other structures in this series.
Notice what never appears: an email from the company's actual domain, a listing for the role on the company's actual careers page, or a person you can reach through the company's actual phone number. The platform address is standing where all of that evidence should be.
Why the usual checks feel like they pass
People who know the domain rule from our look-alike domain guide sometimes wave this one through, because the logic seems to hold: the address isn't Gmail, isn't misspelled, and traces back to Google. But the rule was never "trust addresses that verify." The rule is "trust addresses the employer owns and controls." Shared platform addresses — AppSheet, form services, survey tools, file-sharing notifications — are a category of their own: technically genuine, evidentially worthless. A real company's recruiting team has its own domain, its own applicant system, and its own careers page. It does not need to borrow a no-code platform's no-reply address to offer you a job.
How to check who is actually behind it
- Ignore the platform; identify the sender. The app's name, the message's branding, and the "from" name were all typed in by whoever built the app. None of it is verified by Google. Ask: which company's systems would this come from if it were real — and is this that?
- Find the job where the company keeps its jobs. Go to the named company's real website yourself and check its careers page for the role. Absent there, the offer's foundation is gone.
- Follow no link in the message. Interview confirmations, onboarding forms, and offer letters for real jobs live inside the employer's own applicant system, reached from the employer's own site — not from a link in a platform email.
- Contact the company through its own number or contact page and ask whether they sent it and whether the role exists. Do not use any contact details inside the suspicious message itself.
- Treat the follow-ups as the verdict. If responding leads toward a chat-app interview, document requests, fees, or a check, you are no longer evaluating an email — you are inside the standard structure, and the exit is the same as every version: stop, save everything, report it.
The same trick, other envelopes
AppSheet is the current favorite, not the only one. The pattern — a genuine automated email from a genuine platform, carrying a fake employer's message — also arrives via form-confirmation emails, shared-document notifications, calendar invitations, and survey tools. The defense does not change with the envelope: a platform's address authenticates the platform. Only the employer's own domain, careers page, and people authenticate the employer.
How careersteer.app helps
Platform-sent offers are built to look verified at exactly the layer most people check. careersteer.app investigates the source of a job offer against checked, real data points — who is actually behind the offer, whether its details connect to the real company at all — and produces an evidence-based report before you follow a single link in it.
Frequently Asked Questions
Is no-reply@appsheet.com a scam address?
The address itself is a real Google platform address used by thousands of legitimate apps — and by scammers' apps, which is the problem. It is a shared sending address, like a postmark from a mail house: it tells you which service carried the message and nothing about who wrote it. Any job offer arriving from it should be treated as unverified until the named company confirms it through its own channels.
But the email passed my spam filter and shows as verified. Doesn't Google check the sender?
Google verifies that the message came from its platform — which is true, and why it passes authentication checks. Google does not verify that the person who built the app is the company named in the message, that the job exists, or that the links are safe. Authentication answers "did this service send this email," never "is this employer real."
I applied for jobs recently — how did they know?
Often they didn't need to know anything specific. These campaigns run at volume against scraped and breached lists of job seekers, and the messages are written generically enough — a big company name, a plausible role — to match applications many recipients genuinely have open. A lucky guess that lands is indistinguishable from inside knowledge, which is why the feeling of "they must know about my application" should never substitute for verifying through the company's real site.
The AppSheet email links to a form asking for my details for an interview. Is filling it in risky?
Yes — that form is the point of the message. Every field you complete (contact details, date of birth, ID numbers, banking information "for setup") goes to whoever built the app, not to any employer. Interview scheduling for real jobs does not require your SSN, your bank, or a photo of your license, and it does not happen through an anonymous form behind a platform address.
What other sender addresses work the same way?
Any shared or automated address: form and survey platform notifications, shared-document and file-delivery notices, calendar-invite senders, and "no-reply" addresses belonging to tools rather than to the company itself. Whenever the address belongs to a service, ask the only question that matters — where is the message from the employer? If there isn't one, there isn't an offer yet.
Offer arrived from a platform address instead of the company itself? Check who's actually behind it first.
First scan free, no card required.
Run a free scan