That innocent holiday snap might be doing more than showing everyone how good the weather is. A new scam highlighted by The Guardian shows how criminals can use AI to analyse photos posted on Instagram and Facebook, work out where they were taken, and then use that information to make phishing messages look frighteningly legitimate.
The trick is surprisingly simple. Imagine posting a few family photos from Porto without mentioning the city anywhere. A few days later, a text arrives claiming that your bank detected unusual card activity while you were travelling in Porto and asking you to verify your details through a link. Because the message contains a detail that only someone who knows about the trip should know, it suddenly feels much more convincing. Except the scammer may never have known about the trip at all. The photo told them.
AI doesn’t need your location tag
Research from McAfee tested more than 21,000 travel images using two freely available AI models. One correctly identified the location in 91% of cases, while the other reached 87%. Crucially, the images didn’t need location tags or embedded metadata for the AI to work out where they were taken.
The obvious giveaways are things such as famous landmarks, street signs, storefronts, road markings and recognisable skylines. But AI can apparently dig much deeper than that. McAfee found that even seemingly generic images could reveal useful clues. A beach or hotel room might only give away the country, but that could still be enough information for a scammer to make a message sound credible.
In one test, ChatGPT correctly identified a seemingly ordinary river scene as Hastings-on-Hudson in New York. Another image showing flowers was traced to the Keukenhof gardens in the Netherlands, based partly on the arrangement and combination of flowers in the image.
The scam gets convincing very quickly
Once scammers know where someone has been, they can use that context to make phishing messages far more convincing, whether it’s a fake bank alert about card activity, a suspicious login from the country visited, or even a hotel asking for verification. As McAfee’s head of EMEA, Vonny Gamot, told The Guardian, AI can provide the extra context that makes otherwise generic scams feel much more credible.
The simplest precaution is also the most annoying: consider waiting until the trip is over before posting holiday photos publicly, or at least limit them to friends and family. And if a message claims that a bank account or card has been compromised, don’t click its link, no matter how convincing it looks. Contact the bank directly through its official app, website, or the number on the back of the card instead.
The unsettling part is that scammers don’t need a photo with a famous landmark or location tag anymore. A seemingly ordinary picture can contain enough visual clues for AI to work out where it was taken, turning a harmless holiday snap into useful intelligence. Your photos may be memories to you, but to a scammer with the right AI tools, they can be a surprisingly detailed map of where you’ve been.