Picture this: you’ve landed in the Caribbean, checked in at your hotel, and the view from the balcony is too good not to share. So, you snap a quick photo and thirty seconds later, that sun-drenched photo is live on Instagram. There are no caption and no location tag added. You’ve been careful about that part for years.
Two days later, an urgent text arrives claiming to be from your bank: “Security Alert: Suspicious transaction detected in St. George’s, Grenada. Click here to verify immediately.” Panicked, you click. After all, how could a scammer possibly know you’re in Grenada? You didn’t tell a soul online. Well, you didn’t need to tag it. The photo already told the story.
Recent research from cybersecurity firm McAfee put this to the test, running more than 21,000 publicly available travel photographs through two freely accessible AI vision models that are available for free. One correctly named the city and country more than nine times out of ten. Neither model needed a GPS tag, a caption, or any hidden metadata. It simply looked at the picture the way a very well-travelled, very patient detective might and read it.
How does a photo give so much away?
It comes down to the small things you’d never think twice about. A balcony railing style found only in a particular coastal region. The typeface on a shopfront sign. A regional dish sitting on a restaurant table. The silhouette of a mountain range in the distance. The species of palm lining a beach path. None of these details is a smoking gun on its own, but stitch a handful together, and an AI model narrows the possibilities down fast, often to a specific city within a specific country, sometimes to a specific street.
Beaches and hotel interiors are trickier to pin down precisely, since one stretch of white sand looks much like another. But even then, researchers found the models could usually still nail the country. And a scammer doesn’t need pinpoint accuracy. They need just enough to sound convincing.
Where it turns nasty
This is where the technology stops being a curiosity and starts being a weapon. Once a scammer knows roughly where you are, the follow-up writes itself.
A text lands on your phone a few days into the trip, appearing to come from your bank: unusual activity flagged while you were travelling in Grenada (or whichever country you’re visiting). You weren’t expecting it, but it matches your reality precisely, so the instinct to click and “verify your details” is stronger than it would be for a generic message. That’s the entire trick: plausibility beats sophistication every time.
It doesn’t stop at banking alerts. Armed with your location and a public photo of your face, some scammers are now pairing this intelligence with AI voice-cloning to run “emergency” calls — a distressed relative or friend, supposedly in trouble abroad, urgently needing money wired somewhere. The call and the timing sound right. That’s not luck; it’s research, done in seconds, at zero cost.
And there’s the risk that’s closer to home. A public, real-time trail of holiday photos is also a public, real-time announcement that there’s probably no one home, exposing your physical assets while you stroll the beach. Burglars have exploited “gone on holiday” posts for years; AI-assisted location confirmation only sharpens the target.
What actually helps
The advice isn’t to stop sharing your travels, it’s to change the timing and the audience.
- Post after you’re home, not while you’re there. A photo shared once you’ve returned still lets you relive the trip, without broadcasting your live location to strangers.
- Tighten who can see your account. Public profiles are open books; private, vetted followers are a much smaller risk pool.
- Check photos before posting for the giveaways. Look for hotel names, room numbers, boarding passes, luggage tags, or distinctive local signage in the background.
- Treat “urgent” travel-related messages with suspicion, however well-informed they sound. Verify through a second channel — a phone call to the bank’s official number, a direct call to the relative in question — before acting. Never click links inside unsolicited SMS or WhatsApp messages. Always navigate directly to official apps or call the number on the back of your bank card.
- Arrange for someone trustworthy to keep an eye on your home while you’re away, rather than letting your feed do the announcing for you.
None of this requires giving up the joy of documenting your holiday. It just means letting the story catch up with you, rather than racing ahead of you while you’re still there to be found. As AI grows sharper at interpreting the visual world, our personal security habits must evolve in step. Remember: in today’s digital landscape, a picture doesn’t just tell a story, it broadcasts your exact coordinates in a thousand words.