August 16, 2026, (Inside AI) — Holiday photos posted on Instagram or Facebook are being mined by AI tools to locate travelers and power convincing financial scams. New research from McAfee shows that freely available AI models can identify where an image was taken, even without geotags or metadata.
The scam works like this: a traveler posts a seemingly generic photo from Porto, showing a sliver of the Douro river. Days later, a text arrives claiming the bank detected unusual activity during that trip. Because the message references a location the victim never disclosed, the fraud feels credible.
McAfee tested more than 21,000 travel images using two open AI models. One model correctly identified 91% of images, the other 87%. Staff who replicated the test with personal photos were unsettled by how easily their locations were pinpointed.
Vonny Gamot, head of EMEA at McAfee, explained how AI changes the threat landscape:
"What AI does is give context ... so that makes the scam [and] makes the threats credible," Vonny Gamot, head of EMEA at McAfee.
AI performs best on photos with recognizable landmarks, skylines, signage, or street markings. Food stalls and storefronts also speed up identification. Beaches and hotel rooms are harder to pinpoint, but the system can often identify the country, which is enough for scammers.
In one test, ChatGPT correctly identified a river photo as Hastings-on-Hudson in New York state. Another image of tulips was traced to the Keukenhof gardens in the Netherlands, based on the layout of flowers and smaller blue blooms planted between them.
This capability is not new in computer vision, but its accessibility has changed. Historically, geolocation required specialized skills or reverse image search. Now, open models give anyone the ability to extract location clues from visual details like architecture, light, and signage.
The research highlights a broader shift: AI lowers the barrier for convincing social engineering. Criminals no longer need hacked data or user error. Publicly shared images become a free source of personal context.
McAfee recommends delaying posts until after returning home and tightening privacy settings. Travelers should also be wary of urgent messages and avoid clicking links in texts or emails. Instead, contact banks directly through official channels.
This scam is part of a growing trend where AI amplifies traditional fraud. As image analysis tools improve, the line between public sharing and personal exposure continues to blur.
