Your Instagram Vacation Photos Can Be Used to Scam You, McAfee Research Finds

Post a photo from your trip to Porto with the Douro river in the background. You think it's generic enough. A few days later a text arrives: "We detected unusual activity while you were travelling in Porto, please verify immediately."

You never posted your itinerary. You never tagged your location. So why does the message feel real?

Because AI figured out where you were, according to research from McAfee, the antivirus company. McAfee ran two freely available AI models against a set of more than 21,000 travel images. One model correctly identified the location 91% of the time. The other hit 87%, according to the Guardian.

McAfee staff then tried the experiment on their own vacation photos and, per the Guardian's reporting, came away unsettled by how easily the systems worked.

No metadata required

None of this depends on geotags or EXIF data. The AI reads the picture itself, the same way a person would, but faster and at scale.

"What AI does is give context, so that makes the scam and makes the threats credible," said Vonny Gamot, McAfee's head of EMEA, quoted by the Guardian.

Landmarks, skylines, storefronts, signage and even food stalls are enough for the models to work with. McAfee found that beach shots and hotel-room photos are harder to place precisely, but the system can usually still nail down the country, which McAfee says is all a scammer really needs.

The examples McAfee cites are striking for how little they had to go on. A staffer fed ChatGPT a picture of a river with trees in the foreground. It correctly identified Hastings-on-Hudson, a town in New York state, according to the Guardian. Another photo, just a cluster of flowers, was correctly matched to the Keukenhof gardens in the Netherlands, with the AI reasoning from the tulip layout and the placement of smaller blue flowers between them.

Why the location detail matters to scammers

Tyler McGee, McAfee's head for Asia Pacific and Japan, told Explore that scammers don't need private data at all. "While private photos are naturally more protected, it's important to remember that anything shared publicly could potentially be viewed, collected and analysed by bad actors," McGee said, as reported by the Bendigo Advertiser, the Wellington Times, the Great Lakes Advocate, the Southern Cross and the Mandurah Mail.

McGee's broader point is about psychology, not just tech. "Even if the scammer's information isn't perfectly accurate, mentioning a place you've visited can lower your guard and make the message seem legitimate," he said.

A fake bank alert referencing a real city you visited reads as more credible than a generic phishing text, even if the scammer got some details wrong.

Beyond bank fraud: family targeting and empty-house signals

The location-detection angle is only part of the exposure. Dr Lennon Chang, an associate professor in cyber risk and policy at Deakin University, told Explore that scammers can build fake emergency stories—a sudden hospitalization, a lost wallet—using knowledge of where someone traveled. "Following the posts the scammers can create a persuasive story for the scam," Chang said. Family members who already know the person is traveling are more likely to believe it.

Posting in real time carries a separate risk that has nothing to do with AI location detection. Professor Dali Kaafar, executive director of the Macquarie University Cyber Security Hub, warned that photos posted while still on a trip signal that a home sits empty. "Posting while you're still away is effectively announcing that your home is empty, and it reveals your live location," Kaafar told Explore. He also flagged boarding passes and ticket photos as things people should never post, since those often contain barcodes and booking references that can be exploited directly.

Paul Haskell-Dowland, a professor of cyber security practice at Edith Cowan University, put it plainly to Explore: all of this data has value to scammers, whether the goal is an immediate financial transaction, longer-term financial abuse through collected banking details, or just building a profile for future targeting.

What this doesn't prove

None of the sources here document a specific victim losing money to an AI-geolocated scam text. The research is about capability, what these models can identify, not a confirmed count of fraud losses tied directly to this method. McAfee's numbers describe detection accuracy in a controlled test of 21,000 images, not a tally of real-world scam attempts using the technique.

The practical fix hasn't changed much in the AI era: treat unsolicited "verify your account" messages as suspicious regardless of how specific they sound, don't post live location or boarding passes, and wait until you're home to share the vacation album. The technology got sharper. The scam script stayed the same.