Expensify sent images with personal data to Mechanical Turkers, calls it a feature

Enlarge / Would you let this guy handle your benefit and business expenses?

The “machine learning” behind that application you’ve been using to scan your receipts for business expenses and company benefit filings may not have been entirely machine-based—and that could have some privacy implications, despite what the company has advertised. Expensify, the paperless business expense management service with more than 4.5 million users, has been using humans to transcribe at least some of the expense and benefit documents the company’s software processes—and over the past few months, some of those humans were recruited through Amazon’s Mechanical Turk service.

Until last week, Expensify was using the Mechanical Turk “worker marketplace” to assign “Human Intelligence Tasks” (HITs) to handle receipt scans that the company’s SmartScan technology wasn’t up to deciphering, based on posts on a Mechanical Turk worker board by an Expensify employee and comments by others. One HIT request has since been withdrawn, but others may still be active. The tasks, advertised as Expensify Infra requests, were focused on expense categorization.

Expensify’s requests for HITs have been causing sone suspicion among task-takers. (credit: TurkerHub)

On November 25, Expensify’s founder and CEO, David Barrett, announced a new “feature” the company was working on, called Private SmartScan, in which customers would be offered the option of recruiting their own backup transcription workforce through Mechanical Turk. “I had hoped to keep this feature quiet until next year,” Barrett wrote, “but it seems some enterprising sleuthers have beaten us to the punch. Alas! So with the cat out of the bag, let me proudly announce a new privacy-enhancing feature we’ve been focused on for some time: Private SmartScan! This puts you in control of exactly which humans step in when technology alone is insufficient.”