Do you think you’re being careful when posting your vacation photos? Even without geolocation, this reflex exposes you to a threat that you do not suspect. We put our own shots to the test, and the result is clear.
It’s an almost universal ritual for travelers: immortalizing a terrace on the edge of a lake, the sunset over a wild cove or a magical winter landscape, then sharing this memory with loved ones. For the sake of discretion, many vacationers now take care not to add a location, avoid city hashtags and deactivate GPS tagging. You think you are cautious, convinced that the only potential risk would be to notify potential burglars that your house is empty. In reality, this banal action exposes you to a much more pernicious threat.
It’s a phenomenon well known to cybersecurity experts like McAfee: scammers today rely on artificial intelligence to precisely geolocate vacation photos. In about 9 out of 10 cases, a free and accessible AI model is able to analyze a simple travel photo and correctly identify the location where it was taken. We wanted to check it out for ourselves. We submitted to several artificial intelligences (ChatGPT, Gemini and Claude) a series of our own vacation photos, chosen precisely for their absence of obvious clues and the fact that they have never been posted before.
In less than five seconds, the AI identified a corner of the beach in Cadiz thanks to the style of a lamppost, a cove in the Var by the silhouette of a rock on the horizon, or a Maltese panorama from a simple limestone. All without a complicated prompt: the only question “where was this photo taken?” was enough. But the real shock is not this technical prowess, it lies in what malicious people do with this information. Forget the house visited during your absence: the new weapon of cybercriminals is ultra-targeted scams.
By geolocating your vacation photos, a scammer is no longer just trying to find out if you have left your accommodation. He wants to know where you are, what you are doing and what environment you are in. A false SMS from the hotel where you have just left your suitcases, a call pretending to be a security alert in the exact city where you are staying, a false email from the local police… By anchoring their scenarios in your immediate geographical reality, these scams become almost impossible to detect. So be careful when posting your next vacation photos: they could turn against you. At least, maybe wait until you get home before sharing them on your networks.
The AI is not completely infallible: on certain photos that we provided it, it was only able to make guesses (often correct) without succeeding in finding the precise location. On the other hand, on others, she was able to locate not only the country and the city, but also sometimes the street or the exact point of view. Gemini was the most effective at geotagging our images. Here is an example of one of his analyses: “This photo was taken from the walls of Mdina, the ancient capital of Malta. You were standing on Pjazza tas-Sur, a popular lookout point that offers spectacular panoramic views of the north and east of the island.” Google’s AI recognized the place thanks to the low wall located in the foreground, “built in globigerin stone, this limestone which is the architectural signature of Malta.
We also tested the robots’ accuracy with photos that were much more difficult to identify, such as a photo of a snow-covered tree in the middle of a pristine white blanket. As a result, the AIs failed to find the exact location, but nevertheless made disconcertingly realistic estimates: “Although it is difficult to give GPS coordinates due to the uniformity of the snow, the silhouette of trees crumbling under frost is extremely characteristic of what the Finns call tykky. Where exactly? On the top of a fell (Sami hill) like Kaunispää (in Saariselkä), Levi, Ylläs, or in Riisitunturi National Park.” And once again, it’s right.
