Vacation Photos in the Hands of a Scammer: How Your Posts Can Lead to an Attack

A hotel photo, tagged restaurant, and boarding pass on the table. That's all it takes for a stranger to determine where you are, how long you'll be gone, who you're traveling with, and which bank you use. A few days later, the phone rings: the bank's security department sees a suspicious transaction at your hotel in Rome. The hotel name matches, the city does too, and the date is correct. And that's why this number works.

What a Scammer Can Learn from Your Vacation Photo

From a single post, one can usually determine the country and city, the name of the hotel or restaurant, an approximate return date, accompanying persons, and the airline. If a payment card or receipt is visible in the frame, the bank and card type can also be identified. The rest is supplemented by older posts: a phone number once provided in an ad, an email address, children's names, mother's maiden name.

The location reveals more than just the tagged location. A distinctive building, a license plate, the language on signs, a view from the window, the carrier's logo, the Wi-Fi network name, menu, or hotel wristband can all provide clues.

OSINT, Spear Phishing, and Pretexting

OSINT (Open Source Intelligence) is the collection of publicly available information: from social media, search engines, registries, old ads, and photos. Simply browsing public content is not a crime. The trouble begins when someone uses this information to impersonate a bank, commit identity theft, or take over an account.

Spear phishing is phishing tailored to a specific individual. A mass message speaks generally about a blocked account. Spear phishing knows your name, hotel, city, and travel date.

Pretexting is a fabricated scenario designed to prompt you to act: a mistaken charge at the hotel, a suspended transaction, reservation verification, a scratch on a rental car, or a package held at customs.

This is not theory. In January 2026, CERT Polska warned about a scam 'on accommodation booking': criminals used compromised hotel accounts and data leaks, contacted guests via popular messaging apps, and sent links to a site pretending to be a booking intermediary. The site was designed to collect personal and card data. CERT emphasized that the content of the message and the fake site was highly personalized.

A Boarding Pass Reveals More Than Your Name

This is often the most overlooked element in vacation photos. Krebs on Security described specific cases in 2015 and 2017:

• A six-character reservation code (PNR) and name, both visible on the front of the card, allowed access to the booking site of one airline. There, future flights could be canceled, and passport number, citizenship, passport expiration date, and date of birth could be viewed and changed.
• The barcode contained the full number in the loyalty program, although part of the digits was covered on the card. In one airline, the number along with the name was enough to reset the password by guessing answers to security questions from a multiple-choice list. The airline later added an additional step with a link sent via email.
• Searching for 'boarding pass' on Instagram at that time returned over 91,000 photos. Not all had readable codes, but many did.

These descriptions are from a few years ago, and airline security measures may have changed since then. The principle remains the same: a barcode and QR code can be read from a photo using an app, and covering part of the number does not hide the data stored in the code. Do not publish your boarding pass at all, and destroy the paper version after the trip.

How Such an Attack Looks Step by Step

1. The victim posts a photo from a hotel in Rome, tags the location, and includes a boarding pass and envelope with the room number in the frame.
2. The scammer reviews older posts: a phone number from an ad years ago, an email address, names of family members, and the bank visible on the card.
3. A message arrives: 'The security department detected an attempt to charge your card for 780 euros at the Roma Palace hotel. Please verify urgently.' The hotel name is real.
4. Next comes a request: click the link, log in, provide the SMS code, install the 'secure handling' app, or transfer money to a 'technical account.'

This example is fictional, but the pattern comes from warnings by the police, CERT Polska, and the American FTC, which we quote below.

The Number on the Phone Screen Proves Nothing

The American Federal Communications Commission (FCC) describes spoofing as deliberately falsifying information that appears on the phone display. Scammers use this method to impersonate local numbers, businesses, and agencies you trust. You cannot tell if a call is genuine just by the number displayed, even if you see your bank's number. The FTC states clearly: do not rely on caller ID.

FCC recommendation: if someone claims to be from a company or agency, hang up and call the number from your statement or the official website of that institution. Not the one from which you received the call.

Never Give Your SMS Code to Anyone

The FTC states this without exceptions: never give your verification code to anyone, and anyone who asks for it is a scammer. In warnings about calls 'from the bank's security department,' the FTC adds that this applies to anyone claiming to be a fraud department employee.

The code authorizes logins, transfers, adding devices, changing phone numbers, or adding cards to a mobile wallet. Whoever receives it can perform that operation on your behalf.

Technical Accounts and Safe Accounts Do Not Exist

The Polish police describe this scheme in detail. A fake consultant speaks of suspicious activity on the account and offers to 'secure' the money. They usually ask for your banking login, to enter codes from SMS, to approve a transfer 'to a safe account,' or to install remote desktop applications. Sometimes two people call: first, someone announces a call from the bank, then a 'bank employee' instructs you to transfer your savings to a 'technical account.'

The police remind you of what a real bank employee will never do: they will not ask for full login details, SMS codes, or PINs, will not encourage transfers, and will not instruct you to install remote access applications for your phone or computer. The recommendation is simple: hang up, call the bank's hotline yourself (using the number from the official website or your card), and report the attempted fraud to the police.

The FTC has an alert titled, which is good to remember: Never move your money to 'protect it.' That's a scam. Money left where it is is not at risk just because someone called.

Fake Websites Look Like Real Ones

CERT Polska states that modern phishing mimics the appearance of well-known services so accurately that the appearance of the site does not reveal the scam. The only reliable indication is the address in the browser's address bar, specifically the domain name. In its guide, CERT shows a real fake address that started with the name of a well-known booking service but actually belonged to a completely different domain.

How to read an address according to CERT: find the part between '://' and the first slash, watch out for characters pretending to be slashes or dots, and read the domain from right to left. The main domain is the suffix (e.g., .com, .pl) and the word just before it. Everything further to the left proves nothing.

A padlock next to the address only indicates an encrypted connection. A fake site can have it too. The safest approach is to never open your bank or booking site from a link in a message, but rather from the app or by manually entering the address.

Vacation Photos and Break-Ins: What We Know

This thesis circulates on the internet in a stronger version than the data allows, so let's separate facts from conjectures.

Confirmed case: the police of Devon and Cornwall in England reported that in July 2026, a court in Exeter sentenced six gang members to a total of 49 years in prison. The group planned break-ins in southern England and selected victims on Instagram. Investigators found searches related to two robberies on the perpetrators' phones. The police also believe the gang used tools to search for information in open sources.

What is unknown: percentages of burglars who supposedly 'follow social media' circulate online. We did not find them in police or government studies, so we do not provide them. Individual cases are documented, but the scale of the phenomenon is not studied.

This is still a sufficient reason not to publicly announce that your home will be empty for the next ten days.

How to Remove Location from a Photo

When the camera on your phone has access to location, it saves coordinates in every photo and video (these are called EXIF metadata). The person to whom you send the file can read them. The most important step is the first one, as it works for the future.

iPhone

• Turning off location saving: Settings, then Privacy & Security, Location Services, Camera, and set to Never.
• Removing location from a specific photo: in the Photos app, open the photograph, tap the info button, select edit info and location, and then No Location.
• Sharing without location: select photos, tap Share, then Options and turn off Location. A message will appear above the Options button indicating that location is not included.
• Review: in the Photos app, in albums, you will find a map with all photos that have location saved. It's worth checking there to see the extent on your device.

Option names may vary slightly between system versions. Description according to Apple's personal safety guide (version from September 2026).

Android and Google Photos

Location saving is turned off in the settings of the Camera app. Google notes that the appearance of this setting depends on the phone manufacturer. Note one limitation: in Google Photos, you can only remove approximate or manually added location, while automatically saved location by the camera cannot be removed. Google also states that if you download a photo and send it via email, it will reach the recipient with the original location saved by the phone, without changes made in the app. Therefore, turn off location in the camera before your trip.

Social media services usually process uploaded files, but do not assume that metadata will always disappear. A photo sent via email, messenger, cloud, or public link may retain more information. And location is often revealed by what is visible in the frame.

What to Check Before Posting a Photo

The most effective rule is simple: post after returning. Memories do not lose value due to a week's delay, and a live update clearly states that you are not home.

Before posting, enlarge the entire frame. Check if any document, payment card, boarding pass, receipt, reservation confirmation, QR code or barcode, room number, identifier, or screen of another device is visible. Also consider whether you are publishing images of other people's children.

Privacy settings on social media often change, so we do not provide menu paths that may be outdated in six months. In the help center of your service, check a few things:

• who sees new posts and whether you can limit the visibility of older ones,
• whether location is automatically added to posts,
• who can tag you in photos and whether tags require your consent,
• whether your phone number and email address are visible in your profile,
• whether stories and reels are visible to everyone or only selected people.

The FBI, in a warning about AI-related scams, advises setting accounts to private and limiting followers to people you know.

Warning Signs in Messages and Calls

• Unexpected contact combined with time pressure.
• Threat of account blocking or freezing funds.
• Request for password, PIN, CVV, full card number, or SMS code.
• Login link sent in a message.
• Request to install an app or share your screen.
• Demand for a transfer to a 'safe account,' payment in cryptocurrency, gift card, or money transfer.
• Encouragement not to discuss the matter with family or branch staff.

The last point says the most. Cutting the victim off from people who could recognize the scam is part of the scammer's script, not a bank procedure.

Correct Polish also proves nothing. The FBI warns that criminals use generative artificial intelligence for translations to avoid language errors, as well as to impersonate the voice and image of close individuals.

Family Security Password

In the same warning from December 2024, the FBI recommends establishing a secret word or phrase within the family to confirm identity. The password should not be a pet's name or anything that has ever appeared in posts.

The FBI also advises two things that fit well with the topic of this guide. First, verify the caller: hang up, find the bank or institution's number yourself, and call. Second, limit publicly available recordings of your voice and images of your face as much as possible.

Quick Path: What Has Already Happened

Select your situation, and the scheme will indicate where to start and which part of the guide describes the next steps.

What to Do After Receiving a Suspicious Message

1. Do not click the link and do not respond. Responding confirms that the number is active.
2. Do not provide your SMS code, app code, BLIK code, password, PIN, or CVV.
3. Hang up completely. Do not let yourself be transferred to the so-called security department.
4. Call yourself, from the number on the back of the card, from the official app, or from the statement.
5. In the official app, check recent transactions, the list of devices, saved recipients, and cards added to mobile wallets.
6. Take screenshots, but do not prolong the conversation just to gather evidence.

What to Do If Data Has Already Been Provided

Act immediately. Do not wait for a foreign transaction to appear in your account.

Login or password: go to the real site or app, change your password, log out of remaining sessions, and enable two-factor authentication. Change the same password everywhere you use it, and check if anyone has changed the email address for account recovery.

Card data: contact the bank immediately, block the card, inquire about disputing transactions, and monitor your account for the following weeks. In the USA, the FTC reminds that federal law limits your liability for unauthorized transactions on a credit card, but you must report them quickly to the card issuer.

SMS code or approved operation: tell the bank exactly what you approved. The code may have authorized a transfer, adding a device, changing a phone number, or adding a card to the wallet.

Remote access app: disconnect the device from the internet, do not log into the bank on it, and call the bank from another phone. Uninstall the app, check which apps have access to accessibility and screen recording, update and run security software, change passwords from another device. Consider restoring factory settings.

Sent money: immediately ask the bank to attempt to stop or reverse the transfer. With a gift card, the FTC advises calling the issuing company right away, and with cryptocurrency, contact the exchange or ATM operator. There are no guarantees, and recovering cryptocurrency can be particularly difficult.

PESEL, SSN, or document photo: in Poland, block your PESEL (description below). In the USA, the FTC directs you to IdentityTheft.gov if your SSN has already been used, or to IdentityTheft.gov/databreach if it has only leaked.

Scammers Come Back a Second Time

Those who have already lost money are often attacked again. The FTC describes the mechanism: scammers buy, sell, and exchange lists of people who have already paid (so-called 'sucker lists'). Such a list contains a name, address, phone number, type of scam, and amount. Then they call as an agency, consumer organization, law firm, or even as the same company that scammed you, promising a refund.

The FTC states clearly: agencies and legitimate organizations never ask for money to help recover a refund. The FBI adds on the IC3 site that the center does not work with law firms or 'cryptocurrency services' in recovering money and never contacts victims for data or money. Criminals also impersonate IC3.

PESEL Blocking: What It Blocks and What It Doesn't

If a scammer has obtained your PESEL, a photo of your ID, or a broader set of data, block the number. Any adult with a PESEL can do this. The service is free and takes effect immediately.

• Online: at mObywatel.gov.pl. To log in, you need a trusted profile, qualified signature, e-ID, or electronic banking data.
• At the office: at any municipal office, with an ID card (also in the mObywatel app) or passport. The official enters the application into the system and immediately issues a confirmation.

From June 1, 2024, banks and other financial institutions must check if the PESEL is blocked when entering into a contract with you, for example, for a loan or credit. When you need a loan, you can permanently or temporarily lift the block until a selected date and time, after which the system will block the number again.

The most common concern is unfounded. With a blocked number, you can still register for a doctor, redeem prescriptions, withdraw money from ATMs, make transfers, travel abroad, and handle official matters.

Help with blocking: email zastrzeganie-pomoc@cyfra.gov.pl or phone +48 422 535 460 (data from gov.pl).

Where to Report Fraud in Poland

First, contact your bank if you provided financial information, sent money, or approved an operation.

CERT Polska accepts reports through several channels:

• SMS to 8080, operational since November 22, 2023. Use the command 'Forward' (or 'Share'), and if that's not possible, copy the content. Forward the entire message in its original form, do not cut the link. You can also report SMS without links. From one number, you can report a maximum of 3 messages within 4 hours. In Poland, this is free; abroad, the operator's rates apply.
• incydent.cert.pl: a form for suspicious sites, messages, and ads.
• Email cert@cert.pl, especially for suspicious emails.
• The mObywatel app, service 'Safe Online.'

Police: report the case if you lost money, someone stole your identity, took over your account, or is blackmailing you. The police also ask to report any attempt at fraud 'on a bank employee.' Bring screenshots, phone numbers, website addresses, transfer confirmations, and the recipient's account number.

Social media: report fake profiles, hijacked accounts, and ads leading to fake sites. If your account has been hijacked, warn your friends through another channel.

Where to Report Fraud in the USA

• Bank or card issuer, first and foremost.
• ReportFraud.ftc.gov: Federal Trade Commission (FTC), fraud and impersonation of companies or agencies.
• IC3.gov: FBI center for reporting internet crimes. The FBI encourages reporting even if you are unsure if the case qualifies. They do not respond to every report, but in some cases, it is possible to freeze stolen funds.
• IdentityTheft.gov: identity theft and recovery plan.
• Local police, and in case of immediate danger, call 911.

Common Mistakes in Assessing Messages

A Rule to Remember

A true detail in a message does not mean the entire message is true. A scammer may know your hotel name because you published it yourself.

When someone unexpectedly contacts you about money, cards, reservations, or accounts, stop contact. Do not click the link, do not provide the code, do not install the app. Contact the institution yourself, using a number you know.

Frequently Asked Questions

Does deleting a post with location still help?

Yes, it limits further damage, although it does not reverse what someone has already saved. Delete the post or change its visibility, check older publications from the same trip, and turn off location in the camera. If a boarding pass was in the frame, change the password for your loyalty program account and check your reservation.

Can a bank call me about a suspicious transaction?

Yes, but a real employee will not ask for an SMS code, PIN, full login details, a transfer, or installation of an app. If you have even a hint of doubt, hang up and call the number from your card or the bank's official website. This is advised by both the Polish police and the American FTC.

Will blocking my PESEL complicate my life in Poland or abroad?

According to gov.pl, it does not block visits to the doctor, prescriptions, ATMs, transfers, trips abroad, or official matters. However, it will complicate entering into a credit or loan agreement using your data. When you need a loan, you can lift the block online or at the office, even temporarily.

I live in the USA, and a scammer has my SSN. Where to start?

The FTC directs you to IdentityTheft.gov: if the number has already been used, report identity theft and follow the recovery plan. If it has only leaked, follow the steps at IdentityTheft.gov/databreach. Also report the fraud at ReportFraud.ftc.gov.

Can I report a Polish SMS to CERT while abroad?

Yes. Forward the message to 8080. According to gov.pl, you will be charged according to your operator's rates outside Poland.

Sources

As of October 23, 2026. This guide is for informational purposes and does not constitute legal advice. Bank procedures, app settings, and social media services change frequently, so in specific cases, follow the information from your bank and official institutions.