The Cybersecurity Checklist Most Travellers Ignore — Until It's Too Late

You lock your hotel room door without thinking about it. You keep your passport in the hotel safe. You watch your luggage at the airport. Physical security while travelling is instinct for most people.

Digital security? Almost nobody thinks about it — until their bank account is drained from a hotel lobby in Cancún, or their company email is compromised from a coffee shop in London, or their identity is stolen through a charging station at an airport gate they used for eleven minutes.

I've spent years managing IT security operations for a financial institution and consulting with small and mid-size businesses on their security posture. The attacks I see most often don't start with sophisticated hacking. They start with someone connecting to the wrong Wi-Fi network, charging their phone in the wrong port, or logging into a sensitive account on a device they didn't bother to secure before leaving home.

Travel cybersecurity isn't complicated. But it does require preparation that most people skip entirely. Here's what actually matters — and what you can ignore.

The Hotel Wi-Fi Problem Is Worse Than You Think

Most travellers know that public Wi-Fi can be risky. What they don't know is how easy it is to exploit.

A technique called an "evil twin" attack involves setting up a fake Wi-Fi network with a name that looks legitimate — "Marriott_Guest_WiFi" instead of "Marriott_Guest," for example. Your phone or laptop connects automatically because it's looking for familiar network names. Once connected, everything you transmit — login credentials, emails, banking sessions — passes through the attacker's device before reaching the internet. You'd never know the difference.

Hotel Wi-Fi networks, even legitimate ones, are shared environments. Every guest on the same network can potentially see your device if it's not properly configured. The business centre computer that twelve people used before you? It could have a keystroke logger installed that captures every password typed into it.

What to do instead:

Use a VPN — a virtual private network — every single time you connect to Wi-Fi that you don't control. A VPN encrypts your internet traffic so that even if someone intercepts it, they can't read it. Consumer VPN services cost roughly five to ten dollars per month. For the protection they provide while travelling, that's negligible.

If you don't have a VPN, use your phone's cellular data as a mobile hotspot instead of connecting to a hotel or airport Wi-Fi. Cellular connections are significantly harder to intercept than Wi-Fi.

Turn off auto-connect on your devices. Both iPhone and Android allow you to disable the setting that automatically joins known networks. This prevents your device from connecting to a malicious network that happens to share a name with one you've used before.

Never use a shared public computer for anything that involves a login. Not email. Not banking. Not social media. If you wouldn't type your password on a stranger's laptop, don't type it on a hotel business centre desktop.

Charging Stations: The Threat Most People Laugh Off

"Juice jacking" sounds like something from a bad spy movie. It's not.

USB charging stations in airports, hotel lobbies, and conference centres use the same physical port that transfers data. When you plug your phone into an unfamiliar USB port, you're potentially giving that port access to the data on your device — photos, contacts, messages, and in some cases, the ability to install software without your knowledge.

The FBI issued a public warning about this in 2023. It wasn't theoretical. It was based on documented incidents.

What to do instead:

Carry your own charging cable and wall adapter. Plug into an electrical outlet, not a USB port. This eliminates the data transfer risk entirely because a standard power outlet doesn't have a data channel.

If you must use a USB port, use a "data blocker" — a small adapter that sits between your cable and the USB port, allowing power through while physically blocking the data pins. They cost less than ten dollars and fit on a keychain.

Carry a portable battery pack. A fully charged external battery gives you a full day of phone use without needing to plug into anything public.

Your Phone Is the Biggest Target — Treat It That Way

For most travellers, their phone is their boarding pass, their hotel key, their banking app, their email, their two-factor authentication device, and their camera — all in one object. Losing it or having it compromised isn't an inconvenience. It's a full-spectrum security event.

Before you travel:

Update your operating system and all apps. Security patches fix known vulnerabilities. Travelling with an unpatched device is like travelling with an unlocked suitcase — you might be fine, but you're making it unnecessarily easy for someone who isn't.

Enable biometric authentication (fingerprint or face recognition) and set a strong PIN as backup. A four-digit PIN can be shoulder-surfed in a crowded airport terminal. Use six digits at a minimum, or better yet, an alphanumeric passcode while travelling.

Turn on remote wipe capability. Both Apple and Google offer the ability to erase your device remotely if it's lost or stolen. Make sure this is enabled and that you've tested it before you leave. A lost phone with remote wipe enabled is a hardware loss. A lost phone without it is a data breach.

Review which apps have access to your location, camera, microphone, and contacts. Travel is a good time to audit permissions you've granted and revoke the ones you don't actively need.

While travelling:

Turn off Bluetooth when you're not using it. Bluetooth vulnerabilities exist across both iOS and Android, and they can be exploited in crowded spaces like airports and train stations, where an attacker can be within range without drawing attention.

Be cautious with QR codes. Restaurants, museums, rental car companies, and parking meters have all moved to QR-code-based systems. Attackers overlay fake QR codes on top of legitimate ones, redirecting you to phishing sites that look identical to what you'd expect. If a QR code takes you to a login page, verify the URL before entering credentials.

Don't post your travel plans or current location on social media in real time. Broadcasting that you're 2,000 miles from home tells anyone watching — including automated bots that scrape public profiles — that your house is empty and your routine has changed.

For Business Travellers: The Stakes Are Higher

Everything above applies to leisure travellers. Business travellers face additional risks because they're carrying organisational data, not just personal information.

Corporate email accessed from an unsecured network can expose internal communications, client data, financial information, and strategic plans. A single compromised business account can give an attacker a foothold into an entire organisation's systems through lateral movement.

Additional precautions for business travel:

If your organisation provides a travel laptop or phone, use it. Dedicated travel devices contain only what's needed for the trip, minimising exposure if the device is lost or compromised.

Use multifactor authentication on every account that supports it — and make sure your second factor isn't solely dependent on the phone you're carrying. A backup authentication method (a hardware security key like a YubiKey, or backup codes stored securely) ensures you're not locked out if your device is lost.

Avoid discussing sensitive business matters on speakerphone or in public spaces. Competitive intelligence gathering through eavesdropping isn't espionage fiction. It happens in airport lounges, hotel bars, and conference hallways.

If you're crossing an international border, be aware that customs officials in many countries have the legal authority to inspect electronic devices, including requiring you to unlock them. Know your organisation's policy on this before you travel. Some companies provide wipe travel devices specifically for border crossings and sync data via secure cloud access after arrival.

The Five-Minute Pre-Travel Security Checklist

You don't need to become a cybersecurity expert to travel safely. You need to spend five minutes before your trip doing what most people don't.

One: Update everything. Phone, laptop, tablets — operating systems and apps. Do this the day before you leave, not at the airport.

Two: Turn on your VPN. If you don't have one, sign up for a reputable consumer VPN service. Set it to connect automatically on untrusted networks.

Three: Pack a wall charger and a portable battery. Leave the temptation to use public USB ports out of the equation entirely.

Four: Enable remote wipe and verify your backups. If the worst happens, you want to be able to erase the device and restore from backup when you get home.

Five: Disable auto-connect for Wi-Fi and Bluetooth. Take control of what your devices connect to instead of letting them decide for you.

None of this is expensive. None of it is time-consuming. And all of it dramatically reduces the risk of turning a vacation or business trip into a cybersecurity incident.

The Mindset Shift That Matters Most

The biggest cybersecurity risk while travelling isn't technical — it's behavioural. People relax their habits when they're outside their normal environment. They connect to networks they wouldn't trust at home. They leave devices unattended in ways they never would at the office. They click links and scan codes without the scepticism they'd apply at their desk.

Attackers know this. Travel is one of the highest-risk periods for personal and corporate data compromise precisely because people let their guard down when they're in transit, on vacation, or focused on a business agenda.

The fix isn't paranoia. It's preparation. Five minutes of setup before you leave, and a baseline awareness of the risks while you're away, is the difference between a trip you remember for the right reasons and one you remember because it took six months to recover your identity.

Travel smart. Stay patched. Use a VPN. And never plug your phone into a port you don't own.

Credits. Edith L. Forestal, CISSP, CISM, CASP+/SecurityX | Founder, Forestal Security

Edith L. Forestal is a CISSP, CISM, and CASP+/SecurityX-certified cybersecurity professional and the founder of Forestal Security (forestalsecurity.com), a cybersecurity consulting platform focused on community banks and SMBs. He brings 23 years of law enforcement experience with the Kokomo Police Department to his cybersecurity work and holds a Master's degree in Cybersecurity and Information Assurance from Western Governors University.