Travel and Public Places

Travel puts your phone, laptop and wallet in places you do not control: a hotel safe, a tray at airport security, the passenger seat of a rental car. Most trouble is ordinary. A phone left in a taxi. A card number copied at a gas pump. A text that says your package is stuck. The steps below take about an hour to do before a trip, and most of them last for years.

Before you go

Update and back up

Install pending updates on your phone, tablet and laptop a few days before you leave, not at the airport. Updates close the holes criminals use (lesson 02 covers them). Then make a fresh backup. If a phone is lost or stolen, a backup turns a disaster into an inconvenience. On an iPhone, open Settings, tap your name, tap iCloud, then iCloud Backup, and choose Back Up Now while on Wi-Fi. A free iCloud account includes 5 GB of storage, which may not hold a full backup, so check the number on that screen. On Android, open Settings, search for Backup, and run a backup through Google. On Windows 11, open Start, type Windows Backup and turn on the folders you want. Lesson 11 covers backups in full.

Lock everything and turn on tracking

• Use a screen lock on every device: a six-digit PIN or longer passcode, plus Face ID or fingerprint if you like them. A swipe-only phone is an open book.
• Turn on Find My on iPhone (Settings, your name, Find My) and Find Hub or Find My Device on Android (Settings, Google, Find My Device, menu names move). Do the same on laptops.
• Make sure disk encryption is on for laptops: BitLocker or Device Encryption on Windows, FileVault on a Mac. Lesson 02 shows where to find them. An encrypted laptop that is stolen is a lost laptop, not a lost life.
• Turn on two-step sign-in for email, banks and your phone account (lesson 03).

Leave extras at home

Take only the cards you will use. Leave the Social Security card, the spare checkbook and the passport photo copies in a safe place at home. Leave any Medicare or insurance card you will not need on the trip at home too. Only take the laptop if you need it. Fewer things can be stolen. The EFF and the Freedom of the Press Foundation suggest, for people with sensitive data, carrying a separate low-cost travel device with only what the trip needs. Most households do not need to go that far.

Give someone your plan

Tell one trusted person where you will be, and how to reach you. Write down the numbers for your bank's fraud line, your cell carrier and your card companies, and keep that list somewhere other than your phone. U.S. citizens traveling abroad can enroll for free in the State Department's Smart Traveler Enrollment Program (STEP) at step.state.gov to receive safety alerts and make it easier for the embassy to reach you in an emergency.

Tell your bank?

Many banks no longer require a travel notice, because their fraud systems watch for odd spending. Policies differ, so check your bank's app or website. If a card does not work abroad, call the number on the card. Turn on transaction alerts before you leave so you see every charge within seconds.

At the airport, hotel and café

Public Wi-Fi

Years ago, public Wi-Fi was risky because most websites did not encrypt your data. The FTC now says that because of widespread encryption, connecting through a public Wi-Fi network is "usually safe" (FTC, as of October 2026). Look for the lock symbol or https in the address bar. The FTC also warns that scammers can build fake sites with encryption too, so even encrypted data is not safe from the people running a fake site.

That leaves a few sensible rules:

• Connect only to the network the staff tell you is theirs. A fake network named "Airport Free WiFi" is a classic trap, so ask or read the sign.
• Skip banking on a laptop in a café if you can use your phone's cellular data instead. Your phone's own data connection is usually safer than a network shared with strangers.
• Do not click login pages that pop up after you connect, unless they are the plain "I agree" page for the hotel.
• Turn off automatic Wi-Fi joining for open networks. On iPhone: Settings, Wi-Fi, tap the "i" beside a network, turn off Auto-Join. On Android: Settings, Network and internet, Wi-Fi, saved networks.
• Keep your devices updated and use two-step sign-in. If a password is stolen, the second step still stops the thief.

A VPN, short for virtual private network, wraps your connection in an extra layer. It helps on a hostile network and hides your activity from the Wi-Fi operator, but it does not make you invisible to the websites and apps themselves, and a bad VPN company can see more than your hotel would. Lesson 04 explains this.

Hotel room TVs, USB ports and charging stations

This is the "juice jacking" worry: a rigged USB port that could steal data from a phone. In April 2023 the FBI's Denver office and the FCC both posted warnings about free charging stations. The real-world evidence is thinner than the headlines. Brian Krebs, a security reporter, wrote that an expert he spoke with knew of no public accounts of juice jacking kiosks being found in the wild, and that it was unclear what prompted the alerts. The FBI later described its post to a fact-checker as a standard public-service post that stemmed from the FCC's warning (Krebs on Security). Researchers have shown such a kiosk can be built, and that is why the habit is worth having.

The cheap fix: carry your own wall charger and cable, plug into an outlet, or use a battery pack. If you must use a USB port and your phone asks "Trust this computer?" or "Allow access to data?", say no. Modern phones ask before sharing data. Do not plug your phone into a hotel TV's USB port to "mirror" your screen without a reason, and sign out of apps like Netflix on a hotel TV before you check out.

Hotel rooms

• Use the room safe for passports, spare cards and a backup drive, knowing a determined thief can open one. Hiding a laptop under a mattress is no safer.
• Lock your laptop screen when you step away and close it when you leave the room.
• Do not use the hotel business center computer for banking or email. You do not know what is installed.
• Never print a boarding pass or document with a barcode and then leave it in the tray. A boarding pass barcode can carry your name and booking details.

ATMs, gas pumps and card readers

A skimmer is a hidden device that copies your card, and sometimes a camera records your PIN. The FBI estimates skimming costs consumers and banks more than $1 billion a year, and says tourist areas are popular targets (FBI). Its advice, in plain words:

• Look at the card slot and keypad. If anything looks loose, crooked, scratched or a different color, walk away.
• Pull gently on the keypad edge and the card reader. Real parts do not come off.
• Use ATMs inside a bank or a well-lit indoor location when you can.
• Cover the keypad with your other hand when you type your PIN.
• At the gas pump, pay inside, or tap your card if the pump allows it.
• Use a credit card where you can. The FBI notes that using a debit card with linked accounts puts more at risk.
• Turn on transaction alerts and watch your account while you travel.

The money rules explain why credit cards are better on the road. For an unauthorized credit card charge, your liability is at most $50, and often nothing if you report it before use. For a debit card you must report within 2 business days to cap your loss at $50, and after 60 days from the statement the loss can be all of it (FTC). Debit cards also pull money straight from your checking account, so a thief's charge can leave you without cash for the rest of the trip.

Shoulder surfing

Someone watching you type a PIN or password, or filming it, is shoulder surfing. It happens in crowded airports, on trains and at checkout lines. Cover the keypad. Turn your screen away. On a phone, use Face ID or fingerprint rather than typing your passcode in public where possible. If you see someone standing too close, step away or ask them to give you room.

Crossing a border with phones and laptops

This section explains what the published policy says in general terms. It is not legal advice, and rules can change or differ for non-citizens. U.S. Customs and Border Protection (CBP) publishes its device-search policy, updated in January 2026 as Directive 3340-049B (CBP). The directive took effect January 1, 2026 and replaced Directive 3340-049A. The points below follow its text. Check CBP's page for the current version.

Type of search	What it is	Suspicion needed
Basic search	An officer looks through the device without connecting outside equipment	None. It can be done at the officer's discretion.
Advanced search	An officer connects equipment to copy or analyze the data	Supervisor approval and reasonable suspicion of a violation CBP enforces, or a national security concern
Cloud data	Files stored online and not on the device	Officers are told not to intentionally access it. Travelers may be asked to switch on airplane mode.

Officers may ask for your passcode. If you do not provide access, the policy lets CBP hold the device, generally for no more than five days, though that can be extended. You should get a written receipt. The rules also say searches by ICE or Homeland Security Investigations follow ICE's own policy. A federal appeals court, the Fourth Circuit, ruled on July 13, 2026 (United States v. Belmonte Cardozo) that a manual search of a phone at the border is routine and needs no warrant or suspicion, as reported by Bloomberg Law and the Electronic Frontier Foundation. What the courts will allow is still changing.

Most travelers are never asked. If you are, staying calm and polite matters. Some practical points from the EFF and Freedom of the Press Foundation checklist:

• U.S. citizens cannot be denied entry to their own country, though they may face delays or having a device held.
• Back up first. Keep the backup at home or in the cloud, not in your bag.
• Power devices off before the checkpoint. That turns on disk encryption and makes data harder to read.
• Use a long passcode, not a short PIN, and avoid relying only on Face ID or a fingerprint, which are easier to demand than a memorized code. If you do hand a passcode over, type it in yourself instead of saying it aloud.
• Only carry the data you need. A phone with five years of messages is an easy target for curiosity.

Visitors to other countries face other rules, and some countries require a visa, a registered SIM or a declared device. Read the State Department's page for your destination before you go.

On the road: SIMs, ships and cars

Calling and data abroad

Ask your carrier about an international plan before you leave. Many phones now support an eSIM, which lets you add a local data plan without a plastic card. Install eSIMs through your carrier or the phone maker's own menu, not through a link in a text. Phone numbers are valuable. If a carrier asks you to confirm a "SIM change" you did not request, call the carrier on its official line. Set a number-lock or port-out PIN on your account before you go (lesson 06).

Cruise ships

Cruise ship internet is satellite-based and usually costs money by the minute or the day, which makes "free Wi-Fi" texts and fake portal pages tempting. Use the ship's official Wi-Fi sign-in, not a link sent in a text. Ship cell service, if you turn on roaming at sea, can be billed at very high rates, so put your phone in airplane mode and turn Wi-Fi back on. Keep cards and passports in the cabin safe, and watch the on-board account charges that post to your room.

Rental cars

The FTC has warned that a rental car's built-in system can store your contacts, call logs, texts and places you have been, and that future renters may be able to see them (FTC). Before you return the car, open the infotainment settings, find the list of paired phones, select yours and delete it. Clear any saved destinations, especially "Home." If you only need to charge, use the car's lighter-socket adapter instead of the USB port, which can sync your data. A simple habit helps: never save your home address in a rental.

Laptop theft

Laptops are stolen most often from cars, airport lines and cafés. Never leave one in a parked car, in view or in the trunk. Keep it in your carry-on bag, between your feet in a café, and in the safe at the hotel when you go out. A cable lock helps in some places. Turn on Find My and disk encryption before the trip. If one is taken, change your email password first (lesson 09), then use the tracker.

Back at home: protect the house

• USPS Hold Mail is free and runs from 3 to 30 days. Request it up to 30 days ahead at holdmail.usps.com. It requires a USPS.com account and identity check, done once. For longer trips, use mail forwarding (USPS).
• Ask a person you trust to check on the house, pick up packages, and move a car now and then. Give them a key, not the alarm code written on a note.
• Use timers for a few lights. If your doorbell or cameras are on the Wi-Fi, check that their apps still alert your phone. Lesson 04 covers smart home devices.
• Turn the water heater to vacation mode if it has one, and set your thermostat. Tell the alarm company you will be away.

Do not announce the trip

Photos posted live with a caption like "2 weeks in the sun!" tell strangers the house is empty. Wait to post until you are home. Turn off automatic location tags on photos. Check who can see your posts under your social media privacy settings (lesson 05). If a relative posts your trip, ask them kindly to wait. An out-of-office email that says "I'm away until the 20th" can go to scammers too, so write "I'll reply when I can."

When you return

1. Look through the transactions on every card and bank account you used. Report anything odd within the same day.
2. Change your email password if you used a hotel computer or a shared device.
3. Update your phone and laptop. Then review which apps have your location.
4. Remove the foreign eSIM plan or switch the phone back to your normal plan, and check your carrier bill for roaming charges.
5. Check your credit file once if you lost a wallet or passport. A passport that is lost should be reported to the State Department at travel.state.gov.
6. Delete trip photos from phones you borrowed, and sign out of apps on any shared devices.

Questions and answers

Is hotel Wi-Fi safe for banking?

For most people it is acceptable if the site shows the lock, the app is current and you use two-step sign-in. If you want more safety, use your phone's cellular data or a personal hotspot for banking.

What is a personal hotspot?

It is your phone sharing its cellular data as a small Wi-Fi network for your laptop. On iPhone, go to Settings, Personal Hotspot. On Android, Settings, Network and internet, Hotspot. Use a strong password and turn it off when you are done.

Should I use a charging cable that says "data blocker"?

A USB data blocker is a small plug that only passes power. It is cheap and harmless, but your own charger in a wall outlet does the same job.

My phone is in my pocket at the airport scanner. Can the scanner hurt it?

No. Security screening does not damage phones. Keep your phone and wallet on your body or in a bag you can watch, and do not put them in a loose tray with strangers' bags behind you.

Do I need to carry my passport and all my cards?

Carry only what you will use that day. Leave the passport in the safe unless you need it, and carry a photocopy. Leave the Social Security card at home.

Is it safe to use my phone's pay feature, such as Apple Pay or Google Wallet?

Yes. Tap-to-pay with a phone uses a one-time code instead of your real card number, which is safer than swiping a card at a stranger's reader. It also helps against skimmers.

What if my phone is lost or stolen on the road?

Use the steps in lesson 09: mark it lost from another device, call your carrier to suspend the line, change your Apple or Google password and tell your bank. If it is stolen abroad, the nearest embassy or consulate can help with a lost passport.

Should I bring a different phone for a foreign trip?

Most people do not need to. A cheap phone used only for the trip is a fair idea if you want less risk at a border or in a country you worry about, but it is extra work.

Do text messages from "customs" or "the airline" mean anything?

Treat them as suspect. A text saying a bag, package or ticket needs a fee, a link or a gift card is almost always a scam. Check in the airline's own app or call the number printed on your ticket.

Hard questions

Do I have to give border officers my passcode?

The policy says officers may ask and that you are expected to present the device in a way that allows inspection. If you do not, CBP may hold the device. U.S. citizens cannot be refused entry to their own country, but the delay, a held phone or a long questioning can be stressful. The risk is higher for visitors and non-citizens. The courts have not settled every part of this question, so decide ahead of time what you will carry, back up and stay calm.

Is a VPN worth it for travel?

It can help on a network you do not trust, and it can hide your browsing from a hotel. It does not fix a stolen password, a fake website or a malicious app, and a poorly chosen VPN company can be a worse watcher than the café. If you want one, pick a well-reviewed paid service from a company that has had its no-logs claims independently audited, and not a free one that makes money from your data. Most people do fine with updates, two-step sign-in and cellular data for banking.

Should I leave my smartphone at home to be safe?

For nearly everyone, no. A phone with Find My, a lock and a backup is more help than risk on a trip: maps, boarding passes, your bank's alerts and a way to call home. A loss without a backup is the worse outcome.

Is it safe to leave my home with smart cameras and a doorbell on?

Yes, if the devices have unique strong passwords, two-step sign-in on the account and current updates. A camera that keeps recording and alerts your phone can help. Be sure someone can respond to an alert, since a notification no one reads does nothing.

Do I have to put up with ads that follow me when I search for my trip?

You can turn some of that off. Lesson 05 shows how to limit ad tracking in your browser and phone.