Your holiday photo may reveal its location before you ever mention it. Common AI tools can identify where a photo was taken more than 90% of the time, giving criminals a powerful way to add believable details to scams.
That changes the risk around personal images. A picture shared for friends and family can expose travel clues, while a hacked account can turn private material into a tool for harassment, sextortion, stalking, or fraud.
AI Can Turn Travel Details Into Scam Evidence
McAfee tested two AI models on more than 21,000 travel images, and the results showed how much information a holiday photo can carry. One model identified 91% of the images accurately, while the other reached 87% accuracy.
The models studied details that people may overlook, including backgrounds, architecture, signage, and light. A building, road marker, landscape, or pattern of daylight can help AI pinpoint where an image was taken, even when the person who posted it gave no location information.
That ability gives criminals a new way to make messages feel personal. If an attacker knows a person recently travelled to a specific location, a scam can mention that destination and sound like it comes from someone familiar with the victim’s plans.
“What AI does is give context … so that makes the scam [and] makes the threats credible,” said Vonny Gamot, head of EMEA at McAfee.
The danger comes from the combination of speed and detail. Criminals do not need to rely on a vague message when an image can provide clues about where someone has been. AI analysis can help them pinpoint travel locations and build those details into threats or fraudulent contact.
Hacked Accounts Create A Second Path To Harm
The location risk is only one part of the wider problem. Hackers also break into personal accounts to steal explicit images, then sell those images on criminal marketplaces, often with personal details attached.
The FBI reports that cybercriminals target social media accounts belonging to adults and children to steal explicit images. Attackers rely on brute-force methods, impersonation, and phishing, using several routes to get past account security.
- They take passwords from leaks and try them against personal accounts.
- They impersonate social media representatives.
- They send phishing emails designed to trick people into sharing access details.
An unsolicited message claiming to come from a social media company can therefore become the first step toward account theft. A request that looks like routine account support may instead give attackers a way to capture a password or obtain access.
The harm does not end when an account is recovered. Victims can face harassment, sextortion, stalking, or the distribution of stolen content, and attackers can use personal information to continue targeting them.
“Victims often face re-victimization through harassment, sextortion, stalking or other targeted attacks, such as advertising stolen content on a victim’s own social media page,” the FBI states.
The FBI indicates that attacks especially target young boys and considers these attacks a public health issue. That warning places account protection alongside the wider need to prevent stolen images from being shared, sold, or used to threaten victims.
Simple Account Defenses Still Matter
The FBI recommends using unique and complex passwords for accounts, because a password exposed in one leak should not unlock another service. Password managers can help people create and store those passwords without reusing the same details across platforms.
Multi-factor authentication adds another barrier. Even if an attacker obtains a password through a leak, impersonation attempt, or phishing email, a second verification step can block access.
The FBI also advises people to avoid storing sensitive images online. That step cannot remove every risk, but it limits the amount of private material available if an account is compromised.
- Use unique and complex passwords.
- Store passwords with a password manager.
- Enable multi-factor authentication.
- Stay suspicious of unsolicited contacts claiming to represent social media companies.
- Avoid storing sensitive images online.
Holiday photos now carry more than memories. Their backgrounds and visual details can help AI identify locations, and those clues can give criminals the context they need to make a scam sound real.
The next time a message mentions a recent trip or claims to represent a social media company, pause before responding. Strong passwords, multi-factor authentication, careful image storage, and caution around unexpected contacts can make the difference between a harmless message and the start of an attack.
Based on
- ‘We detected unusual activity’: the scam that uses AI to exploit your holiday photos — theguardian.com
- Criminals are hacking into people’s accounts to steal intimate images, FBI warns | The Independent — independent.co.uk
- FBI says cybercriminals are hacking into victims’ online accounts to steal their intimate pictures | TechCrunch — techcrunch.com
