Scammers are using AI to figure out where your holiday photos were taken

[Karen88]

Criminals are using publicly available AI vision models to analyse holiday photos posted on Instagram and Facebook, work out exactly where they were taken, and use that location detail to make phishing scams far more convincing. Research from McAfee tested more than 21,000 travel images using two freely available AI models, and found one achieved 87% accuracy at correctly geolocating a photo and the other hit 91%, without relying on any metadata or embedded GPS coordinates at all, just visual clues like architecture, signage, and street markings.

The mechanics are simple and genuinely unsettling. Post a vague holiday photo from somewhere like Porto without mentioning the city anywhere, and a few days later a text arrives claiming your bank detected unusual activity while you were travelling in Porto, asking you to verify your details through a link. Since you never actually mentioned the trip publicly, the message feels far more credible than a generic scam attempt, even though the scammer never actually knew about the trip at all, the photo told them.

McAfee's Vonny Gamot, head of EMEA, explained the mechanism plainly, saying AI provides the extra context that makes an otherwise generic scam feel specific, timely, and genuinely believable. Photos with recognisable landmarks, skylines, distinctive signage, or storefronts get identified most reliably, while pictures taken on a beach or inside a hotel room are harder for the AI to place accurately.

The Guardian reported that staff who took part in a related experiment became visibly uncomfortable with how easily their own travels were pinpointed from images that contained no obvious identifying details at all. The broader context makes this genuinely costly territory, with criminals stealing an estimated £1.28 billion through payment fraud and scams in the UK last year across more than 4.1 million reported cases, a figure that rose 11% year on year according to UK Finance data.

The advice from experts is straightforward if slightly deflating. Wait until you're actually home before posting holiday photos publicly, or limit them to friends and family rather than a fully public account, since posting live location details while still travelling also separately signals that your home is currently empty

'We detected unusual activity': the scam that uses AI to exploit your holiday photoswww.theguardian.com

[GhostRider63]

91% geolocation accuracy from a freely available model with zero metadata is a clearly startling number.

Most people assume stripping location data from a photo before posting is enough protection, and this shows it clearly isn't anymore

[DataProphet]

The staff becoming uncomfortable during the actual experiment detail is a nice piece of reporting.

Seeing your own vague vacation photo get pinpointed correctly probably lands very differently than just reading about the capability in the abstract

[BrokenMitchell27]

Beach and hotel photos being harder to geolocate is a small practical tip buried in here that's actually useful.

If you want to post while still traveling, those specific settings are apparently a quite safer choice than anything with a distinctive skyline or landmark