ClarityCheck people-finder left millions of face photos exposed

Fowler told Wired he was extremely skeptical about ClarityCheck's consent mechanism. The service requires users to agree they have permission to upload a photo, but it is explicitly designed for identification, and people don't typically seek to identify themselves or people they already know. The website includes blog posts with titles like "Find Someone on Dating Sites by Email" and "How to Find Someone on Hinge (Even Without Matching)." Fowler reported to ExpressVPN that the database was neither password-protected nor encrypted and remained publicly accessible for several months. He tracked the database to ClarityCheck, and the company acknowledged ownership and said it has now secured the data.

One of the risks identified by Fowler is that the photos and their associated identities could be used by scammers to create fake social media posts intended to fool family and friends. A common scam involves impersonating a family member in an emergency situation requiring immediate funds to be sent. Access to face photos could help facilitate this type of fraud. According to 9to5Mac, the vast majority of victims likely had no idea their photos had been uploaded to the site and had never granted consent.