After a short break in Porto, you post a few family pictures on Instagram or Facebook. One snap shows a narrow stretch of the Douro river in the background, so indistinct you assume it could have been taken anywhere. Days later, a text message appears: “We detected unusual activity while you were travelling in Porto. Please verify immediately.” You click the link to confirm your bank details, never suspecting that those seemingly innocent photos gave you away. But the message was a scam, and the criminals behind it used artificial intelligence to work out exactly where you had been.
New research shows that AI can pick up on visual clues such as background scenery, architecture, signage, and lighting to determine where a photograph was taken. For criminals, that information lends a dangerous layer of authenticity to phishing texts and emails.
McAfee, the cybersecurity company best known for its antivirus software, tested more than 21,000 travel images using two freely available AI models. The first identified the location of 91% of the photos accurately, while the second got 87% right. When McAfee staff repeated the experiment with their own snapshots, they were uncomfortable with how easily their travels were pinpointed.
“What AI does is give context … so that makes the scam [and] makes the threats credible,” says Vonny Gamot, head of EMEA at McAfee.
The technology does not need tags or embedded metadata. Instead, it scans visual elements like landmarks, skylines, signs, street markings, food stalls, and storefronts, which can reveal a location in seconds. On beaches or in hotel rooms, accuracy drops, but McAfee reports the AI can still often identify the country, and that is all scammers need.
In one test, a McAfee staff member asked ChatGPT to identify a picture of a river with trees in the foreground. The AI correctly named the spot as Hastings-on-Hudson, a town in New York state. Another image of flowers was identified as the Keukenhof gardens in the Netherlands, with the AI deducing from the arrangement of tulips and the small blue flowers planted between them that it was the famous garden.
With location information in hand, criminals can tailor their messages. They might claim your card was flagged for unusual activity while you were in a particular city, or say they are calling about your stay at a specific hotel. They could even reference an attempt to log in to your account from that country and ask you to confirm your identity.
Fraudsters often create a false sense of urgency, telling you to act immediately so you react without thinking. Do not click links in texts or emails. Instead, contact the company or bank using the details on their official website or the back of your card. Adjust your social media settings so only people you know can see your posts, and consider waiting until you are home before sharing holiday pictures.
The takeaway is simple: think twice before posting pictures from a trip while you are still away. Scammers are always looking for new ways to use everyday information against you, and AI has given them a powerful new tool. A delay in sharing could be all it takes to keep your next holiday memory from becoming a financial headache.
