Your passport isn't the only thing worth protecting.

Public Wi-Fi: airport, hotel, café

Free Wi-Fi is how most travellers get online on day one, and most of the time nothing bad happens. The risk isn't that every network is evil. It's that you can't tell which one is.

• Check the network name. Attackers create look-alikes such as “Airport_Free_WiFi”. Confirm the official name on signs or with staff.
• Be suspicious of greedy login pages. A Wi-Fi sign-in that asks for your email password or card details is a red flag.
• Turn off sharing and auto-join. Disable AirDrop/Quick Share for everyone, file sharing, and “auto-join” for networks you used once.
• Use mobile data for sensitive things. Banking and password changes are better on your eSIM's data than on shared Wi-Fi. Sort an eSIM.

VPNs, honestly

A VPN creates an encrypted tunnel between your device and the VPN provider's server. On a network you don't control, that means the hotel, the café or whoever set up a fake hotspot can't see or tamper with your traffic.

Some countries restrict or regulate VPNs. Check the rules for your destination before you rely on one.

Passwords and passkeys

Travel concentrates your most valuable logins on one device: airline, hotel, email, banking. If one password is reused across them, one leak opens the lot.

• One account, one password. Especially email: it's the reset key to everything else.
• Turn on passkeys where offered. Airlines, banks and big platforms increasingly support them, and they can't be phished the way passwords can.
• Never type passwords on shared computers. Hotel business-centre PCs are for printing boarding passes, not logging into email.

Two-factor codes abroad

The classic travel trap: you swap SIMs, then your bank texts a code to the number you just removed.

• Keep your home SIM active as a second line for SMS, with data roaming off.
• Move important accounts to an authenticator app or passkeys before you go.
• Save backup codes for email somewhere you can reach without your phone.

If your phone goes missing

1. From another device, mark it lost (Find My on iPhone, Find Hub on Android). This locks it and shows a message.
2. Call your mobile network to block the SIM so nobody can receive your codes.
3. Change your email password first, then banking and payment apps.
4. Freeze cards in your banking app or by phone.
5. Report the theft to local police for a reference number for insurance.

Before you travel: write down your network's lost-phone number and your bank's card-block number on paper. Yes, paper.

SIM security

SIM-swap fraud is when someone convinces your network to move your number to their SIM, then collects your verification texts. Ask your network about a SIM PIN or port-out protection, and set a PIN on the physical SIM so a stolen SIM can't be used in another phone.

Banking and payment apps

• Tell your bank you're travelling if it still asks; check whether its app works with your travel eSIM.
• Turn on instant spending notifications so you see a fraudulent charge the minute it happens.
• Carry a backup card in a different place from your main one. More in Money Abroad.

Scams and phishing

• Fake booking messages. “Your reservation will be cancelled unless you confirm your card”. Check inside the booking app, never via the link.
• Visa look-alike sites. Unofficial sites charge extra for e-visas and travel authorisations. Use the government domain; our visa briefs link to the official source.
• QR code stickers. Parking meters and menus are a favourite for swapped QR codes. Check the web address before paying.
• “Free” charging cables and USB ports. Use your own plug and cable where you can.

Digital copies of important documents

Keep a copy of your passport photo page, visa, insurance policy and bookings in an encrypted place you can reach from any device, plus an offline copy on your phone. Don't email them to yourself unencrypted and don't post photos of boarding passes: the barcode holds your booking details.