You snapped a gorgeous, deliberately anonymous shot in front of a Costa Rican vista, tagged nothing, mentioned no city, and posted it to Instagram just to show off a little. Harmless, right? Not anymore. Free AI vision tools can now look at that image and figure out exactly where you are — and scammers have noticed.
New research from anti-virus firm McAfee found that AI models can geolocate even the most obscure travel photos with startling accuracy. The company fed over 20,000 images into two freely available AI vision models and asked each to guess where the shots were taken. One hit 87% accuracy; the other reached 91%.
What makes this unsettling is that the models don’t need metadata or embedded GPS coordinates. They work purely from the picture itself, reading clues most humans would gloss over: the architecture in the background, the style of signage, the quality of the light, the vegetation, the shape of a distant mountain range.
“In roughly 9 out of 10 cases,” McAfee says, “an AI model that’s available for free, to anyone, could look at an ordinary travel photo and correctly name where it was taken.” And when the exact city slipped through, the country was almost always right — which, for a scammer, is more than enough.
How the con plays out
Picture that Costa Rica trip again. A few days after posting, still on vacation, you get a text claiming to be from your bank: “We detected unusual activity while you were traveling in Costa Rica — please verify immediately.” It feels legitimate precisely because it names where you are. Nobody knows you’re there — nobody except the AI and the crooks feeding it your holiday snaps.
That’s the whole trick. A vague, generic phishing attempt becomes specific, timely and believable the moment it references your real location. Familiarity reads as credibility, and urgency does the rest.
How to stay ahead of it
- Delay your posts. The simplest defense, as suggested by The Guardian, is to wait until you’re home before sharing travel photos.
- Lock down your audience. Adjust your privacy settings so only trusted people can see your holiday updates.
- Treat location name-drops as red flags. A message that references your exact whereabouts should raise suspicion, not lower it.
- Never click links in texts or emails. If your bank supposedly flagged something, contact them directly using the details on their official website.
The uncomfortable takeaway is that AI geolocation has crossed from clever party trick to genuine security concern. The tools are free, fast and disturbingly accurate — which means the burden of caution now sits squarely with the person holding the phone.
