Holiday Photos Can Reveal Your Location to AI Scammers, Firms Warn

KEMETIC MINDS
Cybersecurity & Scam Daily Briefing — August 17, 2026

Photo: Gustavo Fring via Pexels (source)

• AI can pinpoint where your holiday photos were taken — and scammers can use it to try to steal cash (Mirror, 2026).
• Americans now receive 19.2 billion spam texts a month, nearly triple the 2021 rate (TMCnet, 2026).
• SMS scams account for 35 percent of all phishing attempts worldwide (AOL, 2026).
• A SafePal breach exposed 39,798 customers’ names, addresses, and purchase details (Yahoo Finance, 2026).
• Violent crypto thefts are rising: 46 incidents and $30+ million stolen in the first half of 2026 (Yahoo Finance, 2026).
• About one-third of 510 students surveyed had been involved in cyberbullying (Vejmelka et al., 2020, International Journal of Child, Youth and Family Studies).

1. AI Holiday Photo Location Scam

Watch how a real ai geolocation extortion unfolds — and the red flags that give it away.

Cybersecurity firm McAfee has warned that fraudsters can use artificial intelligence to pinpoint the exact location of your holiday snaps (Mirror, 2026). Criminals can then use that location detail in attempts to trick you out of cash (Mirror, 2026).

The warning, published today, centers on ordinary vacation photos shared online. AI can extract location information from images that look harmless, handing scammers a detail they can use in targeted fraud (Mirror, 2026).

The bottom line: photos you post while traveling can reveal exactly where you are — and that can be the hook for a con (Mirror, 2026).

How to Avoid This Scam

• Turn off location tagging (geotagging) on your phone’s camera before you travel so new photos carry no location data.
• Wait to post holiday photos until you are back home, or share them only with a small, trusted group.
• Avoid including identifiable landmarks, street signs, or your home’s exterior in publicly posted photos.
• If a message references your recent trip or your hometown, treat it as a red flag — scammers collect those details to sound convincing (Mirror, 2026).

2. Smishing Flood: 19.2 Billion Spam Texts a Month

Watch how a real fake package-delivery smishing unfolds — and the red flags that give it away.

Scam texts — known as smishing — have reached critical levels: Americans received an average of 19.2 billion spam texts per month as of late 2023, a near-threefold increase since 2021 (TMCnet, 2026). SMS scams now account for 35 percent of all phishing attempts globally (AOL, 2026).

To fight back, cybersecurity company Surfshark released a real-time protection feature for iOS and Android (TMCnet, 2026). It screens incoming messages for suspicious patterns — such as URLs, sender phone numbers, and message content — and alerts users before they interact with a fraudulent text (TMCnet, 2026; AOL, 2026). The tool uses AI-driven technology and is part of Surfshark’s new scam protection hub (AOL, 2026).

Surfshark senior product manager Dominykas Simkus said modern scams increasingly target human behavior, exploiting “trust, urgency, and exposed personal data” (AOL, 2026). He said the tool is built to spot mistakes or suspicious patterns that people find hard to notice, and that the feature does not retain messages (AOL, 2026).

How to Avoid This Scam

• Do not click links or call numbers in unexpected texts, even if the message appears to be from your bank, a delivery service, or a government agency.
• Go directly to the official website or app to check for alerts instead of using the contact details inside the text.
• Treat any text that asks for passwords, one-time codes, or payment as a scam — legitimate organizations rarely do this.
• Turn on spam filtering in your phone’s messaging app, or consider a tool that screens messages in real time (TMCnet, 2026).

3. SafePal Data Breach Exposes 39,798 Crypto Wallet Customers

Watch how a real fake delivery-update smishing unfolds — and the red flags that give it away.

SafePal, a Bitcoin and crypto wallet maker, said an authorization flaw in its order-tracking plugin gave attackers access to the personal information of roughly 39,798 customers (Yahoo Finance, 2026; AMBCrypto, 2026). The exposed data covers orders placed between March 2, 2025, and April 11, 2026, and includes names, email addresses, shipping addresses, phone numbers, and purchase details (Yahoo Finance, 2026).

The company stressed that seed phrases, private keys, wallet passwords, bank details, payment card numbers, and government IDs were not involved, and no funds were directly stolen (Yahoo Finance, 2026). SafePal — a non-custodial wallet, meaning users control their own funds — says it has fixed the issue, emailed affected customers, and set up a page where customers can check exposure using their order ID and shipping country (Yahoo Finance, 2026; AMBCrypto, 2026).

This type of leak is especially dangerous for crypto holders. Names, home addresses, and evidence of crypto ownership can steer criminals toward wealthy targets, and so-called “wrench attacks” — where victims are threatened or assaulted until they surrender crypto — are rising (Yahoo Finance, 2026). Chainalysis documented 46 violent incidents in the first half of 2026 with more than $30 million stolen, saying the year is on pace to be the worst on record, with home invasions increasingly overtaking kidnappings (Yahoo Finance, 2026).

SafePal is one of several recent wallet-related breaches. Days earlier, hardware wallet maker Trezor disclosed that a breach at shipping partner ShipMonk compromised data on about 13,700 customers, and Ledger’s 2020 leak of some 272,000 customers’ details led to a wave of phishing and, for some, ransom threats invoking violence (Yahoo Finance, 2026). The news follows the Coldcard exploit, which drained long-dormant Bitcoin through a firmware flaw and pushed industry-wide losses toward $130 million (Yahoo Finance, 2026).

How to Avoid This Scam

• If you use SafePal or another self-custody crypto wallet, check your email for breach notices and use the official exposure-check page with your order ID and shipping country (AMBCrypto, 2026).
• Never share your seed phrase — the backup words that can unlock your wallet — or your private key with anyone, no matter who asks (Yahoo Finance, 2026).
• Treat any email claiming to be from SafePal, Trezor, or Ledger offering “help” or “security checks” as suspect; open the company’s website directly rather than clicking links (Yahoo Finance, 2026).
• If you hold meaningful crypto, avoid linking your real name, home address, and wallet ownership in public — breached data with addresses is a known driver of physical theft (Yahoo Finance, 2026).

What the Research Actually Says

Research shows that automated detection tools can help protect ordinary people. A 2025 study in Computers & Security describes a machine-learning model — a “fuzzy deep neural-stacked autoencoder” — for detecting phishing attacks used in social engineering, the tactic of manipulating people rather than hacking computers (Vidyasri & Suresh, 2025, Computers & Security). In plain terms, computer models can be trained to flag scam messages that humans might not recognize.

Another line of research focuses on prevention habits. A study in Police Practice and Research examined online victimization risk and how police-led cyber fraud prevention programs can teach self-protective strategies (Drew & Farrell, 2018, Police Practice and Research). The value here is concrete: programs that train specific protective behaviors, rather than just raising awareness, are the prevention approach researchers study.

Online risks also reach children. A study of 510 high school students living in dormitories in Croatia found that 3.73 percent showed severe internet addiction, while about one-third were involved in cyberbullying as a victim, perpetrator, or both (Vejmelka et al., 2020, International Journal of Child, Youth and Family Studies). Students involved in cyberbullying had significantly higher levels of internet addiction, suggesting a relationship between those two behaviors (Vejmelka et al., 2020, International Journal of Child, Youth and Family Studies).

These findings connect directly to today’s headlines: scammers increasingly exploit human behavior and urgency rather than technical flaws (AOL, 2026), and the phones, apps, and social platforms families use every day are the front line.

Today’s Family Safety Checklist

• Hold a short family talk about today’s scams — children face real online risks, and one study found about one-third of students surveyed were involved in cyberbullying (Vejmelka et al., 2020, International Journal of Child, Youth and Family Studies).
• Teach one protective habit everyone can use: when a message creates urgency, stop and verify through an official app, website, or phone number before acting (Drew & Farrell, 2018, Police Practice and Research).
• Turn on automated scam filtering where you can; machine-learning detection is a promising, researched tool against phishing messages that are hard for humans to spot (Vidyasri & Suresh, 2025, Computers & Security).
• After any data breach — SafePal, Trezor, or elsewhere — expect follow-up scams and treat unexpected calls, texts, and emails as guilty until verified (Yahoo Finance, 2026).

References

1. Bing News. (2026, August 17). Warning issued over scammers who could use AI on holiday snaps. mirror.co.uk
2. Bing News. (2026, August 16). Surfshark fights back against the rise in scam texts with a new protection feature. tmcnet.com
3. Bing News. (2026, August 17). Surfshark fights back against the rise in scam texts with a new protection feature. aol.com
4. Bing News. (2026, August 17). SafePal Bitcoin Wallet Data Breach Stokes Fears of Physical Attacks. finance.yahoo.com
5. Bing News. (2026, August 17). SafePal data breach exposes 39K users – Why phishing risks are rising. ambcrypto.com
6. Vejmelka, Matkovic, Borkovic (2020). ONLINE AT RISK! ONLINE ACTIVITIES OF CHILDREN IN DORMITORIES: EXPERIENCES IN A CROATIAN COUNTY. International Journal of Child, Youth and Family Studies. doi.org/10.18357/ijcyfs114202019938
7. Drew, Farrell (2018). Online victimization risk and self-protective strategies: developing police-led cyber fraud prevention programs. Police Practice and Research. doi.org/10.1080/15614263.2018.1507890
8. Vidyasri, Suresh (2025). FDN-SA: Fuzzy deep neural-stacked autoencoder-based phishing attack detection in social engineering. Computers & Security. doi.org/10.1016/j.cose.2024.104188