Scammers are using AI to figure out where your holiday photos were taken

[Karen88]

Criminals are using publicly available AI vision models to analyse holiday photos posted on Instagram and Facebook, work out exactly where they were taken, and use that location detail to make phishing scams far more convincing. Research from McAfee tested more than 21,000 travel images using two freely available AI models, and found one achieved 87% accuracy at correctly geolocating a photo and the other hit 91%, without relying on any metadata or embedded GPS coordinates at all, just visual clues like architecture, signage, and street markings.

The mechanics are simple and genuinely unsettling. Post a vague holiday photo from somewhere like Porto without mentioning the city anywhere, and a few days later a text arrives claiming your bank detected unusual activity while you were travelling in Porto, asking you to verify your details through a link. Since you never actually mentioned the trip publicly, the message feels far more credible than a generic scam attempt, even though the scammer never actually knew about the trip at all, the photo told them.

McAfee's Vonny Gamot, head of EMEA, explained the mechanism plainly, saying AI provides the extra context that makes an otherwise generic scam feel specific, timely, and genuinely believable. Photos with recognisable landmarks, skylines, distinctive signage, or storefronts get identified most reliably, while pictures taken on a beach or inside a hotel room are harder for the AI to place accurately.

The Guardian reported that staff who took part in a related experiment became visibly uncomfortable with how easily their own travels were pinpointed from images that contained no obvious identifying details at all. The broader context makes this genuinely costly territory, with criminals stealing an estimated £1.28 billion through payment fraud and scams in the UK last year across more than 4.1 million reported cases, a figure that rose 11% year on year according to UK Finance data.

The advice from experts is straightforward if slightly deflating. Wait until you're actually home before posting holiday photos publicly, or limit them to friends and family rather than a fully public account, since posting live location details while still travelling also separately signals that your home is currently empty

'We detected unusual activity': the scam that uses AI to exploit your holiday photoswww.theguardian.com

[GhostRider63]

91% geolocation accuracy from a freely available model with zero metadata is a clearly startling number.

Most people assume stripping location data from a photo before posting is enough protection, and this shows it clearly isn't anymore

[DataProphet]

The staff becoming uncomfortable during the actual experiment detail is a nice piece of reporting.

Seeing your own vague vacation photo get pinpointed correctly probably lands very differently than just reading about the capability in the abstract

[BrokenMitchell27]

Beach and hotel photos being harder to geolocate is a small practical tip buried in here that's actually useful.

If you want to post while still traveling, those specific settings are apparently a quite safer choice than anything with a distinctive skyline or landmark

[MJF_Fan]

Also worth noting, this same technique presumably works just as well against professional and business travel photos. Not just personal holiday posts, corporate social media accounts sharing conference or trip photos could be leaking the exact same kind of exploitable location data

[BanterQueen]

Not sure how effective simply waiting to post actually is as a defense long term.

Given how fast these AI geolocation tools keep improving, feels like the practical advice might need to get more sophisticated than just delay your posting

[Andy81]

Not sure how social media platforms themselves might respond to this. Feels like there could be a real product opportunity in warning users before they post if a photo contains enough visual information to be reliably geolocated by exactly this kind of tool

[NWO]

The home is empty signal is the detail that should worry people more than the phishing angle. Live posting while traveling isn't just a financial scam risk, it's also just straightforwardly telling anyone paying attention that your house is currently unoccupied. Still think about it sometimes

[Freddie_85]

The Porto example is such a clean illustration of why this specific scam works so well. The credibility comes entirely from a detail the victim never actually shared themselves, which flips the usual don't click suspicious links advice on its head since this doesn't look suspicious at all

[StormForge89]

£1.28 billion in UK payment fraud losses last year puts this in real financial perspective.

This isn't a theoretical risk being discussed in a research paper, it's already a massive and growing category of actual crime

[StarfleetCaptain]

Nice writeup! highlighting a particularly underappreciated privacy risk, most online safety advice focuses on obvious stuff like passwords and phishing links, this is a much more subtle vulnerability that most people have probably never even considered