Artificial intelligence can now analyze ordinary social media photos and determine where they were taken — even when location data and geotags have been removed.
Scammers can use those details to make phishing messages more convincing, such as sending a fake bank fraud alert that references a place the victim recently visited.
Consumers can reduce the risk by limiting who sees their social media posts, waiting until they return home to share vacation photos and independently verifying unexpected messages before clicking links or providing information.
That vacation photo you posted on Instagram or Facebook may tell a scammer considerably more than you realize.
Artificial intelligence tools have become remarkably good at figuring out where a photograph was taken simply by examining what's visible in the image. That means removing a photo's GPS information or skipping the location tag may no longer be enough to conceal where you are — or where you've recently been.
New research from cybersecurity company McAfee demonstrates how that capability could give scammers another way to personalize their attacks.
McAfee Labs tested more than 21,000 publicly available travel photos with two freely accessible AI models. Google's Gemma3 27B correctly identified the city and country in 87% of the photos, while Qwen3 VL 30B did so in 91%, according to McAfee.
In other words, in roughly nine out of 10 cases, an AI model could determine where a travel photo was taken based on the image itself.
That's potentially valuable information for a scammer.
How a vacation photo can become a phishing tool
Imagine posting several photos while vacationing in Spain. None are geotagged, and your captions don't say where you are.
An AI system may not need those clues.
It can analyze features in the photographs — including architecture, signs, storefronts and natural surroundings — and potentially determine the location. Even photos without famous landmarks can contain useful visual clues. McAfee found that when its AI models failed to identify the correct city, they could still frequently determine the country.
Now imagine receiving a text that appears to come from your bank:
"We detected unusual activity on your card in Spain. Click here immediately to verify these transactions."
The fact that you really are in Spain makes the message considerably more believable.
But the scammer didn't necessarily get the information from your bank or steal your GPS data. Your vacation pictures may have supplied the clue.
The criminal's objective is still familiar: Get the victim to click a phishing link, disclose account credentials, provide personal information or send money. AI simply provides another way to make the bait more convincing.
McAfee researchers say the technology can turn information hidden in ordinary photos into material for highly targeted scams.
AI is changing an old scammer tactic
Personalized phishing isn't new. Criminals have long collected information about potential victims from social media, public records and data breaches.
What AI changes is the amount of work required to analyze that information.
A criminal once might have needed considerable research or specialized knowledge to identify an obscure location from a photograph. AI can automate much of that analysis and potentially perform it at scale.
The FBI has already warned that generative AI is making financial fraud easier to produce and more believable. Criminals are using AI-generated text for phishing and social engineering, synthetic images to support fraudulent identities and voice cloning to impersonate relatives and other trusted people, according to the agency.
The photo-geolocation technique is another example of the same broader change: AI doesn't necessarily create an entirely new crime. Instead, it can make familiar scams faster, cheaper and much more personalized.
Your photos can be useful to scammers in other ways
Location isn't the only information criminals can extract from social media photos.
The FBI warned in December 2025 about criminals taking publicly available photographs and altering them to create fake "proof of life" images for virtual kidnapping scams. In those schemes, criminals contact someone claiming to have kidnapped a loved one, then use manipulated photos or videos to make the threat appear genuine and demand a ransom.
The examples illustrate an important change in how consumers should think about posting photographs online.
A picture isn't merely something other people can see anymore. It can also be data that an AI system can analyze, categorize, manipulate and combine with other publicly available information.
How consumers can protect themselves
You don't have to stop sharing vacation pictures, but it's worth reconsidering when, where and with whom you share them.
Wait until you're home to post travel photos. Posting pictures in real time can reveal that you're away from home and give criminals timely information they can incorporate into a scam. McAfee recommends avoiding real-time sharing of your location and travel itinerary.
Make social media accounts more private. Review who can see your photos, stories and older posts. The FBI recommends limiting online access to images and voice recordings and restricting social media followers to people you know.
Remember that removing a geotag isn't enough. AI can infer a location from what's actually visible in the photograph. Signs and landmarks are obvious clues, but architecture, vegetation and other seemingly insignificant details may also help identify a location.
Be suspicious when an unexpected message knows something about you. A text that correctly identifies your vacation destination, bank, employer or relative may feel authentic. But accurate personal information is no longer strong evidence that the sender is legitimate.
Don't use the contact information in a suspicious message to verify it. If a text claims to be from your bank, don't click its link or call the number it provides. Open your bank's official app or contact the institution using a number you independently know is legitimate. The FBI specifically recommends hanging up on suspicious callers and independently finding the organization's real contact information.
Treat urgency as a warning sign. Scammers frequently try to prevent victims from stopping to investigate by claiming an account will be closed, money is being stolen or a loved one is in danger. The FBI warns consumers to slow down and verify urgent claims independently.
The new rule: Personal information isn't proof
Consumers have traditionally been taught to look for obvious signs of phishing: bad grammar, generic greetings, strange email addresses or messages that don't make sense.
AI is weakening some of those warning signs.
A scammer can generate polished writing, clone a voice, manipulate an image and now potentially examine someone's social media photographs to determine where that person has traveled.
That makes one rule increasingly important: Just because someone knows something about you doesn't mean they are who they claim to be.
A bank alert that names the city you're visiting may be legitimate. But the location itself shouldn't convince you.
Verify the message independently before you click, call or pay.