Emailing receipts into SageFin

Forward a receipt to [email protected] and SageFin reads it, files it, and matches it to a transaction. That is the whole of importing a receipt — nothing to open, nothing to upload.

Receipts arrive on the Transactions page, in the Receipts panel, where you can see what was read off each one and correct it.

Who can email receipts in

Anyone in your household, from their own address, already can. Membership is the permission — there is nothing to set up, and no address to add.

Any other address has to be enrolled first. A shared family address, a partner who has not joined the household, a bookkeeper: all of these need adding once.

Adding another address

Go to Settings → Receipts and find Email receipts in — or, from the Receipts tab on the Transactions page, choose Settings. Type the address and add it.

SageFin then sends that address a short message, and replying to it is what enrolls the address. There is nothing to type — the reply itself is the proof. The request expires after 24 hours, and if it was not expected, ignoring it does nothing.

Why a reply, and not a code you type in

Because they prove different things, and only one of them is the thing that matters here.

A code typed into a web form proves you can read an inbox. What this feature needs is that mail arriving from an address is genuinely yours — a sending identity. Those two come apart more often than you would think, and when they do, the code says yes and the feature still does not work.

A reply proves the exact property, with the exact evidence: it arrives from the address, signed by that address's own mail provider, and it passes the same checks every later receipt passes.

Two addresses that behave in a way worth knowing

A plus address — [email protected] — will not enroll. Sub-addressing is a receiving feature: mail sent to it reaches you, but when you reply, Gmail sends as [email protected]. The reply arrives from the plain address, so the plus address is refused. That is the check working rather than failing — had it been accepted, every receipt you later forwarded would have arrived from the plain address and been turned away instead.

Apple's Hide My Email relay is allowed, with a caveat SageFin will show you when you add it: a relay address is usually a receiving alias too, and mail you send from Apple Mail generally goes out as your real address. It may work; if you use it, add your real address as well.

What you can send

JPEG, PNG, WebP and PDF, up to 4 MB per attachment.

HEIC and HEIF are not accepted, which matters if you are forwarding straight from an iPhone photo library — iOS often stores photos in that format. Attaching from the Photos app usually converts to JPEG, but forwarding an existing HEIC file does not, and it will be turned away.

A receipt with no attachment at all still works. Plenty of merchants send the receipt as the body of the email and attach nothing, so when there is no attachment the text of the message is read instead.

What happens next

Mail is collected about once a minute, so a receipt appears within a minute or so rather than instantly.

From there it is scanned, the merchant, date, total and line items are read off it, and it is matched to a transaction where one can be found. Everything that was read is shown on the receipt, and everything is editable — a scan is a first draft, not a verdict.

When a receipt does not arrive

If the address is not enrolled, the sender gets one message back explaining that the address is not set up and how to fix it. One message, ever — a stranger mailing the address repeatedly is not told repeatedly.

If the attachment was the wrong type or too large, the receipt is not created. Re-send it as a JPEG or a PDF under 4 MB.

If the household has used its monthly scan allowance, the receipt is refused and the sender is told. Each household can have 200 receipts scanned a month, and every route counts against the same allowance — the phone, the web, a retry, and mail alike.

That last one is worth knowing in advance, because it is the one that arrives without warning. A retry spends one. Emailing forty receipts in an evening spends forty.

Is this safe?

Mail is easy to forge, and a receipt is not a harmless thing to accept — it writes line items and notes onto a real transaction in your household. So the checks are stricter than "the address looks right":

• The message must pass DKIM and DMARC, verified by Google before SageFin sees it, with the signature aligned to the sending domain. A forged From: fails this.
• The sender must be a household member or an enrolled address.
• Each message is accepted once — a captured message cannot be replayed later.
• Attachments are scanned for malware before they reach us.

Enrolled senders are also marked so their mail is never filed as spam, which is why the allow-list is the whole policy rather than something layered on top of a spam folder.

Removing an address

Remove it in the same place you added it. Mail from that address stops being accepted immediately, and receipts already filed stay where they are.