Travel security: protecting your phone, laptop and accounts on a trip

Before a trip: back up, update, lock down and take less. At the US border, CBP can search any traveler's device, but only what is stored on it, not your cloud accounts. On the road, the real risks are theft, shoulder-surfing and fake Wi-Fi, not exotic hacks.

By the editors of ProtectYour.com Last reviewed October 19, 2026 5 min read

Affiliate disclosure: this guide links to NordVPN and Amazon. If you sign up through those links we may earn a commission, at no extra cost to you, and that does not change what we recommend. Free options come first, and we say where a competitor is the better fit. How we make money

Key takeaways

Back up your phone and laptop, install updates and turn on Find My or Find Hub before you leave.
CBP can inspect any traveler's device at the border. It says officers may not use your device to reach data stored only in the cloud and will put it in airplane mode first.
In fiscal 2025 CBP searched the devices of 55,318 international travelers out of more than 419 million processed, according to CBP.
Use your phone's hotspot or a VPN on hotel and airport Wi-Fi, and charge from a wall outlet with your own plug.
If a device is stolen, erase it remotely and change the passwords that were saved on it.

Before you go: a 20-minute checklist

Back up everything. If a phone is lost, seized or broken, a recent backup is the difference between an annoyance and a disaster.
Update the operating system and apps. See keep your devices updated.
Turn on Find My (Apple) or Find Hub (Android) and check that you can sign in to it from another device, so you can locate, lock or erase a lost one.
Use a six-digit or longer passcode, not a pattern or four digits, and turn on full-disk encryption on laptops (FileVault on Mac, BitLocker or Device Encryption on Windows).
Make sure two-factor codes will still reach you. If you are swapping SIM cards, SMS codes will not arrive. Move important accounts to an authenticator app or passkeys first (two-factor authentication), and print your backup codes.
Take less. Sign out of accounts you will not need, and leave behind a laptop with work or client files if the trip does not need it.
Write down your bank's and card issuer's overseas phone numbers, kept separately from your wallet.

Our printable security checklist covers the same basics for home.

At the US border: what CBP can and cannot search

US Customs and Border Protection's border search of electronic devices page sets out its policy under CBP Directive 3340-049B. The main points:

It applies to everyone, citizens included. A US citizen will not be refused entry for declining to unlock a device, but the device "may be subject to exclusion, detention, or other appropriate action," and processing may take longer. For foreign nationals, CBP may weigh it in admissibility decisions.
Basic searches are an officer looking through the device by hand. Advanced searches, connecting equipment to copy or analyze it, require reasonable suspicion or a national security concern and a senior manager's approval.
Only what is on the device. CBP says officers "may not use the device to access information that is solely stored remotely," and will ask you to switch on airplane mode, or do it themselves, before a search.
Passcodes you provide are deleted once no longer needed, according to CBP.

Searches are uncommon. In fiscal year 2025 CBP processed more than 419 million travelers at ports of entry and searched the electronic devices of 55,318 international travelers, about 92 percent of them basic searches, according to the same page.

Practical steps

Since CBP searches only what is stored locally, the cleanest approach for sensitive material is to keep it in an encrypted cloud account, not on the phone. Lawyers, doctors and journalists carrying privileged material should tell the officer so; the policy has special handling for it. Other countries have their own rules, some stricter, so check the destination's before you go. This is general information, not legal advice.

Hotel, airport and cafe Wi-Fi

Almost every site now uses HTTPS, so the old warnings about anyone on the network reading your email are out of date. The real risks are fake networks with plausible names ("Airport_Free_WiFi") and captive portals that ask for more than they should. Our full guide is public Wi-Fi safety; the short version for travel:

Use your phone's hotspot when you can; mobile data is harder to intercept.
Ask staff for the exact network name, and never enter card details into a Wi-Fi sign-in page.
Turn off auto-join for networks you do not trust, and forget hotel networks when you check out.
Use a VPN on networks you do not control. It hides your traffic from the network operator.

Public charging and "juice jacking"

The FCC and the FBI have both warned about "juice jacking": a tampered USB port at an airport or hotel that tries to install malware or copy data while your phone charges (FCC consumer advice). Modern phones ask before trusting a new data connection, which makes this hard to pull off, but avoiding it costs nothing:

Plug your own charger into a wall outlet rather than using a bare USB port.
Carry a portable battery pack.
If your phone asks whether to trust a charger or computer, say no.

Theft and shoulder-surfing

A stolen unlocked phone is far worse than a locked one. Thieves watch people type passcodes in bars and stations, then take the phone and change the account password. Shield your passcode, use Face ID or a fingerprint in public, and on iPhone turn on Stolen Device Protection (see iPhone security settings). Android has Theft Detection Lock and related settings (Android security settings).

On a laptop in a plane, train or cafe, the person beside you can read your screen. A privacy filter narrows the viewing angle so only you can see it.

If a device is lost or stolen

Mark it lost, then erase it remotely from Find My or Find Hub.
Change the passwords for email, banking and any account saved on it, starting with email.
Call your mobile carrier to suspend the line, so the SIM cannot receive your codes.
Report it to local police if you need a report for insurance.

Common questions

Can US border agents search my phone?

Yes. CBP can inspect the electronic devices of any traveler, including US citizens, under its border search authority. It says officers search only data stored on the device, not information stored solely in the cloud, and will put the device in airplane mode first.

What happens if I refuse to unlock my phone at the US border?

According to CBP, a US citizen will not be denied entry for that alone, but the device may be detained or excluded and processing may take longer. For foreign nationals, CBP may consider it in admissibility decisions.

How often does CBP search phones?

In fiscal year 2025, CBP searched the electronic devices of 55,318 international travelers out of more than 419 million processed at ports of entry, according to CBP. About 92 percent were basic, manual searches.

Is it safe to charge my phone at the airport?

Use a wall outlet with your own charger or a battery pack rather than a bare USB port, as the FCC advises, and decline any prompt asking you to trust the connection. The risk is low, and those steps remove it.

Your next step

Take the 5-minute self-checkTen questions, a score, and the free fix for each gap. Your answers never leave your browser.

If you want a paid toolAffiliate link

NordVPN

Best for: People who want a polished paid VPN with apps on every device and a large server network.

Not for: Anyone who wants a free VPN, or the most anonymous sign-up possible (Mullvad needs no email).

Visit NordVPN