Experts issue warning over posting vacation photos as AI can work out exactly where you are

Scary new research suggests that fraudsters may be utilising artificial intelligence to analyze their victims’ vacation photographs to run ultra-specific schemes. Here’s how you can avoid being stung.

The FBI announced earlier this year in its Internet Crime Report that the IC3 received approximately 453,000 cyber-enabled fraud complaints in 2025, with Americans over 60 reporting around $7.7 billion in losses, up 37 percent from 2024.

Investment fraud remains the primary driver, with some thieves opting to get extremely technical to extract money from their victims.

New research suggests that these particular scammers are saving vacation snaps you uploaded to social media, running them through AI, and creating specific scenarios to extract big bucks from your bank.

How hackers are using your vacation photos to make scams seem legitimate

Thieves can use AI to extract data from your travel photographs to run scams, a new study suggests (Getty Stock Image)

Anti-virus heroes McAfee Labs have tested the theory by uploading more than 21,000 travel images to two freely available AI models.

The business reported that one programme correctly identified the location of images accurately 91 percent of the time, while the other scored a solid 87 percent success rate.

Results were more successful when images featured landmarks, sinage, street markings, food stalls, and stores.

The AI reportedly struggled slightly with beach photographs and images taken inside hotel rooms.

Real-life members of the McAfee team were asked to replicate the results by uploading their own travel pictures to the AI systems.

One shared an image of a river and trees, correctly identified as Hastings-on-Hudson, an area in New York State.

The AI model correctly deduced that an image of tulips had been taken at the Keukenhof gardens in the Netherlands.

The Guardian reported that staff who took part in the experiment ‘became uncomfortable with how easily their travels were pinpointed’.

Staff said they were 'uncomfortable' with AI knowing their vacation details (Getty Stock Image)

The investigation has highlighted that hackers don’t necessarily need a lot of information to find out where in the world you are right now.

All they need is the country you’re in and they can easily tailor the scam.

For example, travellers who uploaded images from Catalonia may receive a fraudulent bank message that claims someone from the area has tried to access their account.

Or, a scammer who has used AI to analyze your images from the Savoy Hotel in London may call you to report something was wrong with your payment.

"While private photos are naturally more protected, it's important to remember that anything shared publicly could potentially be viewed, collected and analysed by bad actors,” said McAfee head of Asia Pacific and Japan, Tyler McGee.

“Even if the scammer's information isn't perfectly accurate, mentioning a place you've visited can lower your guard and make the message seem legitimate.”

How to avoid being scammed

Professor Dali Kaafar, executive director of the Macquarie University Cyber Security Hub, told the Canberra Times that photos of your boarding pass and real-time locations should never be uploaded to social media.

"Posting while you're still away is effectively announcing that your home is empty, and it reveals your live location,” he explained. “Posting while you're still away is effectively announcing that your home is empty, and it reveals your live location.”

Instead, experts advise waiting until you get home to post photographs online and review exactly who can see them on social media sites such as Facebook, Instagram, and TikTok.

Experts say you should upload images of your holiday after you return home (Getty Stock Image)

“Consider which specific images you share. Remember that others in your photos may not want to be published online,” warned Paul Haskell-Dowland, Professor of Cyber Security Practice at Edith Cowan University.

The Federal Deposit Insurance Corporation (FDIC) has more detailed advice on how you can avoid general scams, including not opening emails from people you don’t know and using strong passwords when signing up for things online.

New website addresses and links sent to you by other people should also be accessed cautiously.

McGee has also said that you should take a moment to think before acting on travel-based scams.

“Pause before acting on urgent requests. Scammers often create a sense of urgency to pressure people into making quick decisions. Taking a moment to verify can prevent costly mistakes.”

Keep yourself up to date on current scams with alerts provided by the Cybersecurity and Infrastructure Security Agency (CISA).