You turned off location services. You didn't tag the restaurant. You didn't even mention the city in your caption. And it doesn't matter — because AI can look at your photo and figure out where you are anyway.

A new study from McAfee tested more than 21,000 travel photos against two freely available AI vision models — not specialized geolocation software, just the kind of general-purpose chatbots millions of people already use. One got the location right 91% of the time. The other hit 87%. No GPS data. No metadata. No location tag. Just the image itself.

Nine out of ten times, a free AI tool can look at your vacation photo and name where it was taken.

What AI Actually Sees in Your Photos

It's not just the Eiffel Tower or the Hollywood sign. AI reads things most people would never notice — the style of a street lamp, the shape of a curb, the species of tree in the background, the way flowers are arranged in a garden, the font on a road sign half-hidden behind your shoulder.

In one of McAfee's tests, ChatGPT identified a seemingly ordinary river scene as Hastings-on-Hudson, New York. Another image showing a flower garden was traced to Keukenhof in the Netherlands — based partly on the specific combination and arrangement of the flowers.

This isn't some classified government tool. It's ChatGPT. It's free. And it's become a social media game — people upload photos and challenge AI to guess the location, GeoGuessr-style. What started as a fun party trick is now a tool that anyone with bad intentions can use.

How Scammers Turn This Into Money

Here's how the scam actually works. You're on vacation in Costa Rica. You post a photo — nothing fancy, just you on a bridge surrounded by trees. No caption, no tag.

A few days later, while you're still away, you get a text: "We detected unusual activity on your account while you were traveling in Costa Rica — please verify immediately."

It feels real. How would a random scammer know you're in Costa Rica? You didn't tell anyone publicly. But the photo told them everything. AI identified the vegetation, the bridge style, the light — and handed them your location in seconds.

Now you're clicking a fake bank link because the message contained a detail that felt too specific to be a scam.

That's the whole trick. AI gives scammers the one piece of context that makes a generic phishing text feel personal and urgent.

It Gets Worse During Summer

According to the FBI, most burglaries happen between June and August. Nearly a third of social media users post vacation photos while they're still away. Another 40% post about trips before they're back home.

Put those together: you post a beach photo. AI tells a criminal you're in Cancún. Your home address isn't hard to find if your profile links to anything public. Now someone knows your house is empty, they know you're a thousand miles away, and they know you'll be gone for at least a few more days.

This isn't theoretical. Burglars who targeted NFL players' homes in 2024 tracked their away games through social media posts. The AI photo geolocation angle just makes it easier and faster — no need to follow someone's schedule when a single photo reveals everything.

What You Can Do About It

Wait to post. The simplest fix is the most annoying one: don't share vacation photos until you're home. If the photo goes up after you're back, nobody can use it to confirm you're currently away.

Limit your audience. If you can't wait, change your settings so only friends and family see your posts — not the public. Most location-based scams rely on scraping public profiles.

Treat location-specific texts as a red flag, not proof of legitimacy. If you get a message that references where you are, that's the scam, not evidence that it's real. Banks don't text you about "unusual activity in Costa Rica." They say "unusual activity" — period.

Don't click links in texts or emails. Open your bank's app directly, or call the number on the back of your card. Every time.

Check the background before posting. Take a second look at what's behind you. Street signs, business names, license plates, school logos, distinctive architecture — AI reads all of it. Crop or blur anything that could identify a specific address or neighborhood.

The Bigger Picture

A Privacy International report warns that AI geolocation creates risks beyond scams — covert surveillance, doxxing, discriminatory profiling, and chilling effects on free expression. If anyone can identify where a photo was taken, people may stop sharing photos from protests, community events, or sensitive locations entirely.

For most people, though, the immediate risk is simpler: a scammer who knows where you are can craft a message convincing enough to make you hand over your money. Stripping GPS data used to be enough to protect yourself. That era is over.

Your photos are memories. But to AI, they're coordinates.