Stay cybersafe while traveling by updating devices before you leave, turning on multi-factor sign-in, carrying only the data you need, treating public Wi-Fi and shared chargers as untrusted, and planning for loss or theft. Most travel risk comes from lost devices and rushed, unusual requests, not from exotic attacks.
What should you do before you leave?
Update everything. CISA's Secure Our World guidance notes that many software updates exist to fix security risks, and recommends installing them and turning on automatic updates. Do this a few days before departure, not at the airport, so any problems show up while you can still fix them.
Back up. Copy your photos, documents and settings somewhere you control. If a phone is stolen, a backup turns a disaster into an inconvenience.
Lock accounts. Use unique passwords stored in a password manager, which CISA recommends for long, random and unique passwords, and turn on multi-factor authentication for email, banking and cloud storage. Make sure you can still receive codes abroad: a text message code may not arrive on a foreign network, so an authenticator app or a security key is more reliable.
Carry less. Take the smallest set of devices and data that does the job. Log out of accounts you will not need and remove sensitive files from the laptop. For a work trip, ask your security team whether a loaner device is available.
Set up device lock and tracking. A strong screen lock and encryption are baseline. Enable the find-my-device and remote wipe features and test them.
How do you handle networks and chargers?
Treat any network you do not control as untrusted. Hotel, airport and cafe networks can be set up by anyone, and a fake network with a familiar name is easy to create. When you must connect, use HTTPS sites only, avoid banking and sensitive work on the network if you can use mobile data instead, and consider a personal hotspot. A company VPN, when your employer provides one, adds protection for work traffic.
Avoid plugging a phone into an unknown USB port or a shared charging kiosk. Bring your own charger and use a wall outlet. If you must use a USB port, a data-blocking adapter prevents data transfer while allowing power.
What scams target travelers?
Rushed situations create openings. Common ones include fake messages claiming a booking problem with a link to "confirm" card details, calls from "the front desk" asking you to re-enter your card, QR codes on posters or parking meters that lead to lookalike payment pages, and messages from "a colleague" requesting urgent help. CISA's phishing guidance applies unchanged: look for urgency and unexpected requests, do not click, and contact the company through a number or app you already trust.
What if a device is lost or stolen?
Act quickly. Use remote lock or wipe, change the passwords of accounts that were signed in, sign out other sessions, tell your bank if cards were in a phone wallet, and report a work device to your employer at once. A strong lock plus encryption and a recent backup make this routine.
A constructed example: an engineer's laptop bag is stolen at a train station. Because the disk was encrypted, the screen was locked and the laptop had been backed up the previous night, the engineer calls the security team from a borrowed phone, they revoke the laptop's sessions and tokens, wipe it remotely if it connects, and the engineer picks up a loaner the next morning. No data was exposed and no work was lost.
What about returning home?
After a trip, treat devices that spent time in unusual places with a bit of extra care. Install pending updates, change passwords you used on shared computers, check account activity for unfamiliar sign-ins and review connected devices.
How to check or apply this
- Update devices and apps several days before travel.
- Back up everything you will carry.
- Turn on multi-factor authentication with an app or key, and test it away from home Wi-Fi.
- Remove files and sign out of accounts you will not need.
- Enable device lock, encryption and remote wipe.
- Use your own charger, and prefer mobile data over unknown Wi-Fi for sensitive tasks.
- Know who to call if a device goes missing.
Quick check
Is public Wi-Fi always unsafe?
Not always, but you cannot verify who runs it. Use HTTPS, avoid sensitive tasks, and prefer your own mobile connection.
Sources
- CISA, Secure Our World
- CISA, Update Software
- CISA, Use Strong Passwords
- CISA, Recognize and Report Phishing
Last reviewed: 18 October 2026.
