That holiday photograph you casually post on Instagram may be doing more than preserving a memory. It could also be revealing where you are- or where you have recently been- to someone looking for clues.A new research exercise by McAfee Labs has found that AI models can identify the location of travel photographs with accuracy of up to 91%, even when the image contains no GPS information, location tag or caption naming the destination. The finding raises a fresh privacy concern: scammers could potentially use publicly available travel photos to work out a person’s location and then build highly personalised phishing messages around it.The research, published as part of McAfee’s Summer 2026 Safer Summer Travel Report, tested more than 21,000 travel images using two freely available AI vision models. While one model identified the city and country correctly in 87% of cases, the other reached 91% accuracy.
AI does not need your location tag
File Photo: Canva
For years, people have been warned that sharing a photo with embedded GPS or location metadata can expose where it was taken. But McAfee’s findings suggest that removing those details may not be enough.The AI models tested by McAfee were asked to identify locations using only what could be seen in the photographs. They did not rely on EXIF data, GPS coordinates, filenames or captions.Instead, the models picked up visual clues- architecture, road markings, signs, storefronts, landscapes, vegetation, transport systems and even cultural details such as food stalls.A photograph does not have to feature the Eiffel Tower or another instantly recognisable landmark to be useful. McAfee found that even less distinctive images could provide enough information for AI to identify the country, although pinpointing the exact city became more difficult.In some of the examples tested by the company, AI was able to identify locations from seemingly ordinary images, including a sunset photograph and even a close-up picture of flowers.
Why should this worry travellers?
Knowing where someone has travelled may sound harmless. On its own, a location is just another piece of information. The problem begins when that information is combined with everything else a person has publicly shared online.A scammer could, for example, find someone’s holiday photographs on Instagram or Facebook, use an AI model to determine the likely destination and then create a message that refers to that trip.Imagine receiving a text saying that your bank has detected an unusual transaction while you were travelling abroad. Or a message claiming that your hotel reservation in a particular city needs to be reconfirmed. The message may not contain any obviously personal information. But because it mentions a place you have actually visited, it can immediately feel more convincing.McAfee describes this as a shift from broad, generic phishing to more targeted and contextual scams. The company says scammers could potentially use publicly shared photographs, AI-powered location analysis and other information to construct messages tailored to an individual.
Your holiday post can become a scammer’s clue
The potential scam does not necessarily require a hacker to break into an account.According to McAfee’s proposed scenario, the process could be surprisingly simple: find publicly available travel photographs, run them through an AI vision model, infer the destination and context, and then use that information to create a convincing message. And the more information available online, the stronger the picture can become.A photograph might reveal the country. A caption could reveal the city. Another post might mention the hotel. A tagged restaurant could reveal where the person had dinner. Together, these fragments can create a surprisingly detailed picture of someone’s movements.That is particularly useful for social engineering, where the goal is not necessarily to break through a technical security system but to make a person trust a message enough to click a link, share information or transfer money.
Real-time holiday posts could carry extra risk
There is another reason timing matters. Posting a photograph after returning home is very different from announcing your location while you are still there.A live holiday post can effectively tell strangers that you are away from home, where you are staying and what you are doing. McAfee’s broader travel research found that around one in five respondents admitted to sharing travel plans in real time on social media.For scammers, this information can make a fraudulent message feel timely.A message about a hotel booking while you are actually travelling, for instance, may seem far more believable than the same message arriving months later.
Does this mean you should stop posting holiday photos ?
The McAfee research does not suggest that every photograph can be accurately located, nor that every AI system has a 91% success rate. The company itself notes that results varied depending on the image, the number of recognisable landmarks and the geographical region.The 91% figure also comes from McAfee’s own testing rather than an independent peer-reviewed study. It should therefore be viewed as an indication of what current AI vision systems can potentially do, rather than a guarantee that any photograph can be geolocated with that level of precision.Still, the underlying privacy lesson is worth paying attention to: a photograph can contain location clues even when you never deliberately share your location.
How to share travel photos more safely
File Photo: Canva
You do not have to give up posting your favourite holiday pictures. A few simple habits can make your digital footprint less useful to scammers.
- Consider posting after you return. If possible, avoid broadcasting your exact location in real time.
- Review who can see your posts. A public social media profile gives strangers much more information to work with than a private account shared only with people you know.
- Be cautious about revealing your itinerary. Hotel names, flight details, restaurant reservations and dates can collectively provide a detailed picture of your movements.
- Treat unexpected messages with suspicion. Even if a message mentions a real place you recently visited, do not assume it is genuine. Verify the claim through the bank, airline, hotel or other organisation using its official website or app rather than clicking a link in the message.
- Do not let familiarity override caution. A scam does not have to get every detail right. If it contains just enough accurate information to make you think, “How did they know that?”, it may already be doing its job.
The bigger takeaway from McAfee’s research is not that every holiday photo is dangerous. It is that the definition of personal information is changing.In the past, people thought of passwords, phone numbers and addresses as sensitive information. Today, even an innocent-looking photograph can reveal where you are, what your surroundings look like and, potentially, where you have been.And with AI becoming increasingly capable of reading those visual clues, the line between a harmless holiday memory and a useful piece of intelligence for a scammer is getting thinner.
