Posting holiday pictures online may seem harmless, but new research suggests that scammers can use artificial intelligence to work out where you have been, even when your photos contain no obvious location tags.
Imagine spending a few days in Porto, taking pictures with your family and sharing them on Instagram or Facebook. None of the posts mentions Porto, your hotel or even Portugal. The background simply shows part of a river and a few buildings.
Days later, you receive a message claiming your bank card was used suspiciously while you were in Porto.
“We detected unusual activity while you were travelling in Porto. Please verify immediately.”
Because the message correctly mentions a place you recently visited, it may appear genuine. But the message could be an attempt to steal your banking information.
The scammers may have worked out your location by feeding your holiday photos into an AI system.
AI can spot clues hidden in ordinary pictures
Research by cybersecurity company McAfee found that publicly available AI tools can identify the locations where many travel photographs were taken by analyzing details that people may overlook.
These can include:
- Buildings and architectural styles
- Road signs and street markings
- Famous landmarks
- City skylines
- Shopfronts and food stalls
- Gardens and the arrangement of plants
- Mountains, rivers and other geographical features
- Lighting and other environmental clues
McAfee tested more than 21,000 travel photographs using two freely available AI models.
One model correctly identified 91 per cent of the images, while the other achieved an accuracy rate of 87 per cent.
The company also asked employees to test the technology using their own photographs. Some were reportedly surprised by how accurately AI could determine where their pictures had been taken.
Importantly, the images did not need to contain GPS information or other metadata for the AI to make its assessment.
Vonny Gamot, McAfee’s head of EMEA, said AI effectively adds context to photographs, giving criminals information they can use to make fraudulent messages appear more believable.
Even an ordinary holiday photo can give away your location
Photographs containing famous landmarks or clearly identifiable streets are naturally easier for AI to locate.
But less obvious images can also reveal useful information.
A photograph showing a river and trees, for example, was correctly identified by ChatGPT as being in Hastings-on-Hudson in New York state during one test.
Another image showing flowers was identified as the Keukenhof gardens in the Netherlands. The AI reportedly used the arrangement of the tulips and smaller flowers between them to recognise the location.
Beach and hotel-room photographs were harder to pinpoint precisely. However, McAfee said AI could still sometimes determine the country where such images were taken.
For a scammer, that may be enough.
How criminals could use the information
Once fraudsters know where you have travelled, they can build that information into a fake message.
They could claim:
- Your bank card was blocked because of suspicious activity while you were abroad.
- Someone attempted to access your account from the country you visited.
- Your hotel booking requires additional verification.
- Your identity needs to be confirmed because of a transaction overseas.
- Your bank needs you to update security information after detecting activity during your trip.
The more accurately the message reflects your recent movements, the easier it may be for criminals to gain your trust.
This is particularly worrying because many people already share travel photos publicly while they are away from home.
How to protect yourself
You don’t have to stop sharing holiday photographs altogether, but a few simple precautions can make it harder for criminals to build a picture of your movements.
Consider posting after your trip. Waiting until you return home removes the opportunity for criminals to monitor your movements in real time.
Review your social media privacy settings. Limit access to your photographs and posts to people you actually know.
Be careful about what appears in the background. Signs, hotel names, tickets, addresses and recognisable landmarks can provide useful clues.
Never trust an urgent message simply because it contains accurate information. Scammers may know your name, location or recent activities and still be impersonating your bank or another organisation.
Don’t use links in unexpected banking messages. Instead, open your bank’s official app or website yourself, or call the number printed on your bank card.
The key lesson is simple: a photograph doesn’t need a location tag to reveal where it was taken. As AI becomes better at interpreting images, seemingly insignificant details in holiday pictures can become valuable information for criminals.
