Your holiday photos can now fund a scam against you
Fraudsters are using AI to turn Instagram and Facebook posts into eerily personalised phishing messages. Here is how the trick works and what to watch for.
Key points
- Scammers use publicly visible holiday photos on Instagram and Facebook to craft targeted text and email scams.
- AI tools can read location clues from a photo, including landmarks and signage, without needing GPS data embedded in the image.
- The scam message mimics your bank and names the exact city you visited, making it feel legitimate.
- Anyone who posts travel photos publicly is a potential target, regardless of how ordinary the image seems.
You post a photo from Porto. The Douro river is just a sliver in the background. You think nothing of it.
A few days later, a text arrives. "We detected unusual activity while you were travelling in Porto," it reads. "Please verify your card immediately."
It feels real because it knows where you were.
How does the scam actually work?
The message didn't come from your bank. It came from a fraudster who read your Instagram or Facebook post, used AI image-recognition tools to confirm your location, then wrote a phishing message, a fake alert designed to trick you into handing over your account details, timed to your trip.
This isn't guesswork. Modern AI can identify cities and specific neighbourhoods from background details most people would never notice. A bridge arch, a tram line, a particular style of tiled building: all readable by the same kind of technology used in Google Lens or Apple's photo search.
Once the location's confirmed, generating a convincing bank alert takes seconds. Large language models, the AI behind chatbots like ChatGPT, can produce fluent, bank-branded text that matches the tone of genuine fraud warnings. Research we covered on 30 July found that AI chatbots outperform human scammers at earning a target's trust, which makes the crafted message harder to dismiss than anything a person would write.
The Guardian first reported on this pattern of geo-targeted fraud emerging from social media posts.
Why does knowing your location make the scam so dangerous?
Most people already ignore generic "unusual activity" texts. Add one real detail and the brain's alarm quiets down.
You were in Porto. The message says Porto. That coincidence feels like proof.
From there, the scammer needs only one thing: for you to tap the link and enter your card details or online banking password. The link leads to a fake bank page built to look identical to the real one.
What should you watch for?
Four things signal this kind of attack:
- The message names a specific place you recently visited and creates urgency around it.
- It asks you to click a link rather than log in through your bank's official app.
- The sender's number or address doesn't match your bank's official contact.
- It demands card details or passwords, information your real bank will never request over text.
If a message like this arrives while you're travelling, go directly to your bank's official app or call the number on the back of your card. Don't tap anything in the message itself.
The simplest prevention is setting Instagram and Facebook posts to friends-only before you travel, or waiting until you're home to share publicly. Removing the real-time signal cuts the scammer's main advantage.
The photo you think is too vague to identify is often the one that gives everything away.
