You are on a short break in Porto and post some pictures of your family on Instagram or Facebook. With a small section of the Douro river in the background, you think it could have been taken anywhere.
A few days later, you get a text saying that your card was compromised. “We detected unusual activity while you were travelling in Porto – please verify immediately,” says the message.
You click on the link to confirm your bank details. Since you have not put any details of your trip on any of your social networks – bar the indistinct pictures – you don’t suspect there is anything suspicious about the messages.
But the text was a fraud designed to extract your financial details. The criminals behind it figured out where you had been on holidays – lending credibility to their text – by using AI to analyse the image for the most sparse signs of where it was taken.
I’ve long refused to post photos of (or even mention) my travels until (long) after I’m home, out of personal OPSEC concerns. Before, it was about protecting against break-ins. Now, it can also protect against scams.
When the ChatGPT geoguessing craze exploded in 2025, it impressed and scared me, as the value and privacy implications were both glaringly obvious. I currently have a long-running geoguessing thread into which I will occasionally drop an image. When it’s right, it’s scarily accurate. Even when it’s wrong, the amount of detail it’s able to pull out from a seemingly innocuous photo is still disturbing.
Don’t share photos while traveling, people.