Scope and search
Two connected Gmail accounts were searched across all folders, including Spam, for messages from [email protected] dated 1 January–14 November 2026. The results were matched against subject lines, message bodies and dates.
Original research / Email security / Recruitment fraud
Fake job offers.
Real sending infrastructure.
I reported recruitment emails impersonating Apple to Xero in May 2026. Its security team told me it was taking steps to prevent similar messages. I identified 15 more sent from Xero's transactional email address afterwards—most recently messages claiming to recruit for Nike and Adidas.
This is an independent analysis of messages received in my own accounts, not a population-wide estimate of scam volume. Xero's sending infrastructure is documented; the identity of the people controlling the messages is not.
22Suspicious messages from
post.xero.com found in 20267Major employers impersonated in their contents
15Messages after Xero's 14 May response
9Received 10–13 November, all in Gmail Spam at review
01 / The context
A pressured jobs market is fertile ground for impostors.
In July–September 2026, the UK had an estimated 691,000 vacancies, according to the Office for National Statistics, down 5.1% from a year earlier. Outside the pandemic, the last comparably low figure was in 2014. The ONS estimate carries a confidence interval and does not measure fraud. Source: ONS, 20 October 2026 ↗
In September, Barclays reported that 45% of Gen Z adults surveyed believed they had been targeted by a job scam, while 69% of Gen Z jobseekers said they had applied for a role without checking its legitimacy. These are survey findings, not figures for the whole UK population. Source: Barclays Scams Bulletin, 10 September 2026 ↗
My inbox illustrates the mechanism, not a causal relationship with the labour market. The messages offered plausible marketing jobs, sometimes with large salary ranges, and invited an application or introductory call. Most were unsolicited.
02 / A documented six-month timeline
I reported it in May. It carried on.
All dates below relate to messages I located in my accounts. The reporting exchange is from my saved Xero support correspondence.
- 28 Jan 2026
The first identified example
A message claiming to recruit a remote Social Media Manager for Toyota arrived through
[email protected]. - 14–15 Apr
Randstad recruitment pretext
Two emails offering remote digital media roles linked to a lookalike application and scheduling domain.
- 13–14 May
Four Apple-themed deliveries
The same fake marketing-recruitment pitch was delivered to two personal address variants on each of two days.
- 14 May
The complaint and Xero's reply
I forwarded an Apple-themed message to Xero's phishing address with the words “Please stop”. In support case
CX0018143152, Xero replied:Our security team has investigated and are now taking steps to prevent similar emails being sent in the future.
Another support correspondence,
CX0018143290, gave general advice about phishing and asked for headers where an email was not on its security noticeboard. These are historical responses, not a new statement on this investigation. - Aug–Oct
Further brand impersonation
Two Hays messages in August and four Louis Vuitton-themed messages in September and October used the Xero sender.
- 10–11 Nov
Six Adidas-themed deliveries
Two distinct recruitment messages each reached multiple address variants, using an external recruitment-domain Reply-To.
- 13 Nov
Three Nike-themed deliveries
The latest identified email offered marketing positions, including a Head of Marketing role, and claimed that its recruitment communications were sent by Xero under an authorised arrangement. That claim was made in the suspicious email itself and has not been substantiated.
What “continued” means: These 15 later messages used the same legitimate Xero domain and displayed related invoice-email metadata. The evidence does not show whether the same Xero account, actor or campaign was responsible, or what Xero did about the accounts reported in May.
03 / How the messages travelled
These weren't merely emails displaying a copied Xero logo.
The original headers of representative messages across the timeline show authenticated delivery from Xero's transactional email infrastructure, including relay.post.xero.com and a Mailgun signature.
REDACTED HEADER EXCERPT13 Nov 2026 · Nike-themed message
Received: from relay.post.xero.com
[198.244.57.61]
From: ... <[email protected]>
Return-Path: [email protected]
Authentication-Results:
spf=pass
dkim=pass [email protected]
dmarc=pass header.from=post.xero.com
X-Feedback-Id: ...:
xero_web_invoice_email
invoices-invoice
xeromailenvironment-live
...:mailgunValues shortened or masked. Authentication outcomes are those recorded by Gmail for this example. Full originals are retained privately for independent verification.
The pattern has been documented independently: security firm IRONSCALES published a separate September 2026 investigation into a Nike recruitment lure delivered in Xero's invoice stream. Its case concerns a different reported inbox and should not be counted as part of my dataset. Read the independent technical analysis ↗
Xero's own security noticeboard ↗ says spammers have misused Xero invoices and Xero Mail to send spam, in a notice dated 17 July 2024. It also distinguishes genuine service emails from lookalikes, and publishes reporting advice.
04 / First-party dataset
22 deliveries. Seven claimed employers. Eleven dated waves.
The table counts individual messages, not unique victims, operators or campaigns. Repeated deliveries to two address variants—and sometimes a third domain address—are preserved as separate mailbox observations.
*November through 14 November. This is a convenience sample from my own Gmail accounts, not an estimate of overall scam activity.
| Employer named | Messages | Dates observed |
|---|---|---|
| Toyota | 1 | 28 Jan |
| Randstad | 2 | 14–15 Apr |
| Apple | 4 | 13–14 May |
| Hays | 2 | 19 Aug |
| Louis Vuitton | 4 | 24 Sep, 8 Oct |
| Adidas | 6 | 10–11 Nov |
| Nike | 3 | 13 Nov |
| Total | 22 | Jan–Nov 2026 |
Download the anonymised message-level observations
22 rows with UTC dates, claimed employers, subject lines, grouping labels, anonymised recipient categories and Gmail Spam classification at the time of review. No private mailbox addresses, full headers or live suspicious links are published.
05 / The wider pattern
Not just Xero.
Additional suspicious recruitment approaches in my mailbox used delivery paths associated with Zoho Desk, Amazon SES, Podia, SparkPost, Recurly, SendGrid and Salesforce Marketing Cloud. Representative examples claimed to recruit for Dior, Omnicom, Publicis, Red Bull, Havas or Meta Pay.
Those messages are not included in the 22 Xero messages. Mail headers establish the transport infrastructure for the examples inspected, not who controlled the accounts or whether the provider knew of abuse. These services have not yet been asked to comment on the findings.
The common vulnerability is a trust gap: an authentic message from a software platform can carry fraudulent text about a company that never authorised the approach. No platform's involvement should be treated as evidence of its endorsement or deliberate participation.
06 / Method, provenance and limitations
Exactly what was counted—and what wasn't.
Counting unit
One received email is one observation, even when near-identical copies go to different addresses. Eleven dated/brand campaign-wave groups were identified; these are editorial groupings, not proven criminal entities. No extrapolation to total victims or sending volume is attempted.
Technical verification
Selected original RFC 822 messages from January, April, May, August, September, October and November were checked for Received, Return-Path, Authentication-Results and X-Feedback-Id. Successful authentication for the shown examples does not independently verify every message.
Privacy and corroboration
The public CSV excludes actual recipient email addresses, raw Message-IDs and active suspicious URLs. Original messages, full headers and Xero's support correspondence are retained privately. Relevant redacted originals can be shared with journalists for verification on request.
Important limitations: Suspicious emails are not proof that the linked sites stole data or money. The operators, their relationship to any Xero account and any provider enforcement action are unknown. Some unsolicited emails could have landed outside the search; this is a documented minimum, not a census. The labour-market statistics and Barclays survey provide background, not proof that economic conditions caused these specific emails.
Xero responded to my original complaint in May 2026. An updated response to these November findings has not yet been obtained. Any substantive response or correction will be dated and added here.
07 / Sources & further verification
Follow the evidence.
- Office for National Statistics — Vacancies and jobs in the UK: October 2026 ↗Published 20 October 2026. Quarterly vacancies and annual comparison.
- Barclays Scams Bulletin — Job scam exposure among Gen Z ↗Published 10 September 2026. Survey-based findings, not national incidence counts.
- Xero Central — Security noticeboard ↗Includes 17 July 2024 acknowledgement of invoice/Xero Mail abuse and current advice.
- IRONSCALES — The Platform Labelled It an Invoice, Then a High Risk ↗Published 17 September 2026. Separate technical case involving Nike branding and Xero delivery.
Journalists: request the underlying evidence
For independent verification, redacted original emails, complete authentication headers and the dated Xero support exchange can be provided privately. Please cite this research page when reporting its original mailbox findings.
Request evidence by email →Research by Duncan Trevithick, independent UK SEO consultant. About the publisher.