Posting holiday pics online? Here's how AI is turning your happy snaps against you

You're posting your holiday snaps online, sharing the joy from your trip abroad - including all those food shots! But then the unthinkable happens: you get scammed.

Sharing vacation reels on social media can turn sinister when cybercriminals use artificial intelligence (AI) to target you.

A new breed of AI allows scammers to track where you went - just by analysing your photos - and come up with highly-personalised travel-related scams.

Research from McAfee Labs found freely-available AI tools can identify where a photo was taken with up to 91 per cent accuracy using visual clues such as signage, architecture, local surroundings, landmarks and food.

McAfee head of Asia Pacific and Japan, Tyler McGee, warns scammers only need to access photos you share publicly on social media to create phishing messages, such as from a bank, claiming your card was used abroad - in the very country you holidayed in.

"While private photos are naturally more protected, it's important to remember that anything shared publicly could potentially be viewed, collected and analysed by bad actors," McGee tells Explore.

These scams work because the location reference feels authentic.

"Even if the scammer's information isn't perfectly accurate, mentioning a place you've visited can lower your guard and make the message seem legitimate," McGee says.

Scammers can also target family members. Dr Lennon Chang, Associate Professor in Cyber Risk and Policy at Deakin University, says scammers can even use a traveller's photo to develop fake distress stories - such as a sudden hospital stay or a lost wallet - to demand urgent funds.

"Following the posts the scammers can create a persuasive story for the scam," Chang says.

"And as the traveller's family and friends know that the person is travelling, there is a higher chance that they would believe the story is true."

If you're posting photos while on holiday, it could be putting you at risk of home burglaries and hotel booking scams.

Professor Dali Kaafar, executive director of the Macquarie University Cyber Security Hub, warns not to post photos of your boarding pass or real-time locations.

"Posting while you're still away is effectively announcing that your home is empty, and it reveals your live location," Kaafar says.

He continues: "Never photograph tickets or boarding passes, and treat any unsolicited 'booking problem' message with suspicion."

All data has value to scammers, says Paul Haskell-Dowland, Professor of Cyber Security Practice at Edith Cowan University.

"Scams may be seeking to generate money (direct financial benefit through a transaction); enable future financial abuse (collecting banking details) or collecting information that can be used directly for future campaigns or sold on," he says.

There is also the potential for images to be trawled and used for generative AI training, or "more concerningly", for deep fakes, which could be used to create hoax video calls to your loved ones, he says.

The experts agree waiting until you get home to post your images online is best, as is limiting who can see your images - such as only immediate family members.

"Review who your friends are," says Haskell-Dowland. "Consider which specific images you share. Remember that others in your photos may not want to be published online."

When it comes to the correspondence you receive, be skeptical of messages that reference your location, warns McAfee's McGee.

"Just because a text or email mentions somewhere you've recently visited doesn't mean it's legitimate. In fact, that can be a warning sign," he says.

Always verify independently: if a message claims to be from your bank, airline, hotel or travel provider, don't click links, but instead contact the organisation directly through its official website or app, he advises.

"Pause before acting on urgent requests. Scammers often create a sense of urgency to pressure people into making quick decisions. Taking a moment to verify can prevent costly mistakes," McGee says.