If you’re logged into your bank account and the image contains embedded code and you’re vulnerable to the exploit, there’s a good chance that they’ll be attempting to transfer money out of your account.

If it sounds like a scam … and this does … it’s generally cheap insurance to treat it like a scam.

Moreover, if it’s unsolicited, as in, they came to you, the chances are significantly higher that it’s a scam.