AI photo analysis reveals location for targeted scams
AI vision models can identify the location where photos were taken with 87โ91% accuracy by analyzing visual elements, even after GPS and metadata are removed. Researchers demonstrate that ChatGPT, Gemini, and Claude successfully identify famous landmarks and specific locations. Scammers could use this capability to target individuals with personalized phishing attacks based on vacation photos posted to social media.
What happened
AI language models including ChatGPT, Gemini, and Claude can identify the location where photos were taken by analyzing visual elements such as buildings, signs, vehicles, vegetation, and landmarks, even when GPS data and EXIF metadata have been removed.
McAfee Labs research found that AI successfully identified photo locations with 87% to 91% accuracy in tested travel photos, using only visual clues present in the image itself.
Reported impact
Scammers can combine AI location identification with social engineering to execute targeted fraud. By analyzing vacation photos posted on social media, fraudsters can identify where users are or have been, then send fake security alerts from purported banks claiming suspicious activity at that exact location, making the scam appear credible.
The technique bypasses traditional privacy protections like removing location metadata, creating a privacy risk that users are not aware of when sharing photos online.
Index analysis
Visual location identification is not dependent on geolocation metadata but extracts clues directly from photograph content, including architectural styles, shop signs, road markings, plant species, natural landmarks, and common scenes like beaches or hotel rooms.
Modern vision models demonstrate unexpectedly strong geographic perception abilities. AI-based geolocation tools analyze buildings, terrain, streets, signs, and environmental details to infer location even when photos contain no GPS or EXIF information.
Governance controls
Social media platforms offer privacy settings to limit photo visibility: on Facebook, changing posts from 'public' to 'friends'; on Instagram, enabling private account mode; on WhatsApp, restricting status and group media visibility to added contacts.
Users can reduce location inference by cropping photos tightly, avoiding distinctive landmarks, and blurring identifying details such as business names. However, the most effective control is managing where photos are shared rather than modifying the images themselves.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.