Travel Cybersecurity: How to Protect Your Devices and Data Abroad

Travel strips away the protections you rely on without meaning to. You leave your trusted home network, you join a dozen unknown Wi-Fi networks, you hand your phone to strangers for photos, you leave a laptop in a hotel room all day, and you carry every account you own in your pocket through jurisdictions with very different rules about what officials can ask of you.

None of this means travel is dangerous. It means the default settings that are fine at home are not fine on the road. This guide covers what to do before you leave, while you are away, and when you get back.

Why Travel Changes the Threat Model

Three things shift at once.

Your device leaves your control more often. Hotel rooms, rental cars, conference tables, airport security trays, and repair shops all create moments where someone else can physically touch your hardware. Physical access is the strongest position an attacker can have.

You use untrusted networks constantly. Airport, hotel, café, airline, and conference Wi-Fi are all networks you know nothing about, operated by people you cannot verify.

Legal protections change at the border. In many countries, including at US and UK borders, officials have broader authority to inspect electronic devices than police would inside the country. Rules vary enormously and can differ for citizens and visitors.

Before You Leave

1. Travel with less

The single most effective step. Do not take data you do not need. Consider leaving your main laptop at home and taking a cheap, clean one. At minimum, remove old client files, tax documents, and archives from the device you carry.

2. Back up everything, then verify the backup

Assume the device may be lost, stolen, seized, or broken. Make a full backup before you go and check that you can actually restore from it. A backup you have never tested is a hope, not a plan.

3. Turn on full-disk encryption

BitLocker on Windows, FileVault on Mac, and default encryption on modern phones. Without it, a stolen laptop is an open filing cabinet — the login password alone does not protect the drive.

4. Strengthen the lock screen

Use a long alphanumeric passcode rather than a four-digit PIN or a swipe pattern. Set auto-lock to one minute. Turn off lock-screen notification previews so messages and codes are not readable from a table.

5. Sort out your 2FA before you go

This is the mistake that ruins trips. If your two-factor codes arrive by SMS and your SIM does not work abroad, you will be locked out of your own accounts in a foreign country.

• Move critical accounts to an authenticator app or passkeys, which work offline
• Print your backup codes and carry them separately from your devices
• Consider a small hardware security key kept in a different bag

6. Set up a VPN and test it at home

Install and verify it works before you travel. Some countries restrict VPN websites, so downloading on arrival may not be possible. Enable the kill switch and auto-connect on untrusted networks.

7. Enable device tracking and remote wipe

Find My on Apple, Find Hub on Android, Find My Device on Windows. Confirm they are on and that you know the account password without looking it up on the device itself.

8. Sign out of what you do not need

Remove work accounts, cloud drives, and password vaults you will not use. Fewer live sessions means less to lose.

9. Update everything

Operating systems, browsers, and apps. Do it on your home network, not on hotel Wi-Fi.

10. Notify your bank and set alerts

Turn on transaction notifications for every card. Foreign fraud is easier to spot when you get a push for each charge.

While You Are Travelling

Wi-Fi

• Prefer your own mobile data or a travel eSIM over public Wi-Fi. Data is cheap now; a compromised session is not.
• Confirm the exact network name with staff. "Hotel_Guest_Free" next to "Hotel Guest" is a classic evil-twin setup.
• Turn off auto-connect to open networks and forget networks after you leave.
• Use your VPN on every untrusted network, and never dismiss a certificate warning.
• Do not do banking or admin work on hotel or airport Wi-Fi if you can wait or tether instead.
• Turn off Bluetooth and AirDrop / Nearby Share when not in use, or set them to contacts-only.

Physical security

• Never leave a laptop in a hotel room if you can avoid it. Hotel safes are convenient, not secure — staff master codes exist and default codes are common.
• Power devices fully off when leaving them, rather than sleeping them. Encryption keys are more protected in a powered-off state.
• Use a privacy screen filter on planes and in cafés. Shoulder surfing is low-tech and effective.
• Do not use public computers in hotel business centres for anything requiring a login.
• Carry your own charger and power bank. Avoid public USB ports, or use a USB data blocker.

Everyday habits

• Do not post live location updates. Announcing that your home is empty for two weeks is a physical security problem. Post the photos when you get back.
• Watch for local scams — fake taxi apps, QR codes stuck over real ones on parking meters and restaurant tables, and "free Wi-Fi, just log in with Facebook" portals.
• Use a credit card, not a debit card, and use tap-to-pay rather than handing the card over.
• Keep a photo of your passport in an encrypted note, not in your camera roll.

At the border

Rules differ by country and by your status, so know the situation for where you are going. Some general points that apply widely:

• Power devices off before reaching the checkpoint. A powered-off encrypted device is in its strongest state.
• Biometrics are often weaker protection than a passcode, both practically and legally in several jurisdictions. Restarting the device forces a passcode on both iOS and Android.
• Do not lie to officials, and do not physically resist. If you are asked to unlock a device, understand the consequences of refusing in that country before you decide — for visitors, refusal can mean denied entry.
• If you handle sensitive client or journalistic material, take a clean device and retrieve what you need over the network after you arrive.

When You Get Back

1. Change passwords for anything you logged into on an untrusted network — email first, then banking.
2. Review active sessions and devices on Google, Apple, Microsoft, and your messaging apps. Sign out of everything you do not recognise.
3. Forget the travel Wi-Fi networks so your phone stops broadcasting requests for them.
4. Check your statements line by line for the next two billing cycles. Card skimming and cloning often surface weeks later.
5. Scan your devices with a reputable security tool, and check for new profiles, admin apps, or configuration changes.
6. Turn off the travel eSIM and remove any temporary accounts you created.

If a Device Is Lost or Stolen Abroad

1. Mark it lost immediately in Find My or Find Hub. This locks it and displays a contact message.
2. Change your primary email password first from another device, then revoke all sessions.
3. Call your bank to freeze cards stored in the device wallet.
4. Contact your carrier to suspend the SIM so it cannot receive your SMS codes.
5. Report it to local police and get a written report — insurance and your embassy will ask for it.
6. Remote wipe once you have secured your accounts, not before, since wiping ends your ability to track it.
7. Watch for follow-up phishing. Thieves often send fake "your device has been found, sign in here" messages to harvest your account password. No legitimate service asks you to log in via a link in a text.

The Bottom Line

Travel security is mostly preparation, not vigilance. The three things that matter most all happen before you leave: carry less data, get your two-factor working offline with printed backup codes, and turn on full-disk encryption with a strong passcode.

On the road, use your own mobile data instead of public Wi-Fi wherever you can, keep the laptop with you, and save the holiday photos for when you are home. Do that and the rest of the trip is just a holiday.