Holiday Photos Are Fuelling a New Bank Fraud Scam
Criminals are scanning public Instagram and Facebook posts, then using AI to craft personalised phishing messages that reference where you were and when.
Key points
- Fraudsters are using publicly visible holiday photos on Instagram and Facebook to build convincing fake bank alerts.
- AI tools can read location tags, captions, and image details to extract where a person travelled and on what dates.
- The scam produces a text or email that quotes your destination back at you, making it feel like a genuine fraud warning from your bank.
- No system was hacked. The only data used is what victims posted themselves.
You post a couple of holiday snapshots on Instagram. A sunlit street, a river in the background, a caption about needing more of this. A few days later a text arrives: "We detected unusual activity while you were travelling in Porto. Please verify your card immediately."
It feels legitimate because it knows exactly where you were. It isn't.
As first reported by The Guardian, this scam combines two things that are now cheap and accessible: public social media posts, and AI tools that can read images and extract details from them. Automated tools scan public profiles for recent travel posts, pull the location, then fire off a spoofed bank message, meaning one designed to look as though it came from your real bank, using your destination as the hook. We covered a related shift in scam detection on 12 August, when WhatsApp began flagging suspicious messages using on-device AI.
How does the scam actually work?
The criminal never breaks into your bank or your phone. They just read what you posted publicly.
AI image-analysis tools, software that can look at a photograph and describe what it contains, can now identify landmarks, street signs and scenery well enough to pinpoint a city. If your post also includes a location tag or a caption naming the place, the job is easier still. A spoofed message then mimics your bank's branding, references your trip, and nudges you to click a link and "verify" your card details on a fake website.
| What the scammer uses | Where they get it |
|---|---|
| Your travel destination | Location tag, caption, or image analysis |
| Approximate travel dates | Post timestamp |
| Your phone number or email | Data broker lists or previous breaches |
| Your bank's name and logo | Publicly copied from the real bank |
Phishing, where criminals send fake messages to trick people into handing over passwords or payment details, works best when the target believes the sender already knows something about them. Your city and your dates are exactly enough to create that belief.
Should people who travel worry?
Not excessively, but the risk is real and easy to reduce with small habit changes.
No regulator has opened a formal enforcement action specifically tied to this technique. The UK's Financial Conduct Authority and the Information Commissioner's Office both cover fraud and personal-data misuse respectively. The scam sits in a legal grey zone: the data was public, so no breach-notification law is triggered, yet using it to defraud someone is plainly criminal.
What's worth watching is how little effort this requires. There's no breach to investigate, no corporate negligence to assign. The mechanism is a public post, a free AI tool, and a spoofed text. That combination scales almost without cost, which is why the habit changes below matter more than waiting for a regulatory fix.
What should you do?
Four practical steps worth taking now:
- Set your social profiles to private, or delay posting holiday photos until after you return home.
- Never click a link in an unexpected text or email about your bank card, however specific it seems. Open your banking app directly, or call the number on the back of your card.
- Your bank will never ask for your full card number or PIN by text or email. If a message asks for either, it's a scam.
- Report suspicious messages to your bank directly and to your national consumer-fraud authority.
