Security
Holiday Season Encryption Checklist: Secure Your Travel Tech and Gift Shopping
December squeezes a year's worth of digital risk into three weeks. You bounce between hotel networks and airport lounges, your phone does double duty as boarding pass and wallet, and every store you have ever bought from has picked this month to email you. None of that calls for panic. It calls for an hour of preparation, most of which you can finish while your coffee goes cold.
Start With the Devices You Will Carry
Phone, laptop, maybe a tablet. Those three hold your email, your tickets, your banking app and, quite often, a saved card number. Before anything else, confirm that each one is encrypted and locked. On modern phones this is mostly automatic: set a passcode and iOS or Android encrypts the storage behind it. On a laptop it is a switch you have to flip yourself.
Turn on the encryption that is already installed
- macOS: System Settings, then Privacy & Security, then FileVault. Save the recovery key somewhere that is not the laptop.
- Windows: Settings, Privacy & security, then Device encryption. If it is not listed, search for BitLocker in the Control Panel. Keep the recovery key out of the same bag as the machine.
- iPhone and iPad: a six-digit passcode plus Face ID or Touch ID is enough. Switch off lock-screen notification previews so messages do not sit in plain sight.
- Android: a PIN or pattern with biometrics, and make sure the screen locks the moment you press the power key.
Then trim what a stranger could read if they picked up your phone while it was open. Log out of banking apps you rarely use, clear stored card numbers from browser autofill, and review which apps are allowed to read your notifications.
Fix your second factor before you need it
Two-factor authentication only helps if you can complete it from a departure lounge. If your codes arrive by text, you are betting on your home SIM working abroad. Move your important accounts — email, bank, password manager — to an authenticator app or a hardware key, and print the backup codes. Email resets everything else, so it should be the best-protected account you own.
Wi-Fi in Hotels, Airports and Cafés
Treat any network you do not control as hostile. Not because someone is certainly watching, but because you cannot tell whether they are. A captive portal that asks for your room number tells you nothing about who else is on that network.
- Use your phone's hotspot for anything involving money.
- Turn off auto-join for open networks before you leave, and forget each hotel network when you check out.
- Watch for copycat names. "Airport_Free_WiFi" and "Airport Free WiFi" are different networks. Ask staff which one is real.
- HTTPS still matters, but it only protects the link between you and that one site. The names of the sites you visit can remain visible to the network.
If you use a VPN, pick a paid provider with a published privacy policy and clear ownership. Free VPN apps have to pay for servers somehow, and the currency is usually your traffic. A VPN moves your trust from the café router to the VPN company; it does not remove the need for care.
Payments: What to Hand Over and What to Keep
Most card fraud starts somewhere mundane — a saved number on a stolen laptop, or a checkout page that looks right and is not.
- Pay with a token, not a number. Apple Pay and Google Pay send a one-time token instead of your card digits, so an unfamiliar merchant never sees them.
- Use a virtual card for one-off purchases. Many banks and issuers let you generate a single-use number. If that shop is breached later, the number is worth nothing.
- Check the domain, not just the padlock. The padlock means the connection is encrypted. It says nothing about who is on the other end.
- Switch on transaction alerts for every card you will carry, and add a travel notice if your bank offers one, so a legitimate purchase abroad does not get frozen mid-trip.
An encrypted connection to a fraudster is still an encrypted connection to a fraudster.
Credit cards generally come with stronger dispute processes than debit cards, and cash comes with none. Confirm the details with your own issuer before you rely on them; this is general guidance, not financial advice.
Delivery Texts, Fake Shops and Your Inbox
Everyone is waiting for a parcel in December, which is exactly why "your package could not be delivered" messages work. The rule is short: never use the link in the message. Open the carrier's app or type the tracking number into the carrier's website yourself.
Fake storefronts are subtler. A shop with polished photos, a countdown timer and a price a third of everyone else's is a warning sign, not a bargain. Look for a real returns policy, a physical address, and contact details that are more than a single web form. If you have already paid somewhere you now doubt, call your card issuer, freeze the card and watch your statements.
While you are in your inbox, fix the passwords that matter. One password manager with a unique password for every account does more for you than a year of good intentions.
Travel Days: Airports, Borders and Other People's Screens
- Skip public USB sockets. Charge from a power bank or a wall adapter with your own cable; the risk is small but the workaround is trivial.
- Assume someone can see your screen. Seat neighbours and queue-mates can read over your shoulder. A privacy filter costs little.
- Pair Bluetooth and AirDrop with contacts only, and turn them off when you are not using them.
- Carry less than you own. Travel with a device that holds only what the trip needs, log out of what you will not use, and back up first so a lost phone is an inconvenience rather than a loss.
Border and device-search rules differ by country and change without much warning. This is not legal advice. If you carry client data or confidential work files, ask your employer what their policy is before you fly.
Home Base: Guest Networks and the Devices You Leave Behind
If relatives are visiting, put them on a guest Wi-Fi network rather than your main one, and keep smart speakers, cameras and TVs there too. Update your router's firmware, change the default admin password, use WPA2 or WPA3, and disable WPS if it is listed. These four steps cover most home network problems.
Shared accounts deserve a thought as well. Streaming passwords passed around in group chats are hard to claw back; a family group or a one-time share link is tidier, and it lets you revoke access later without changing everything.
Last, check that Find My or Find My Device is switched on for every device you are leaving at home, and that you know how to wipe one remotely. Knowing the steps before you need them is most of the battle.
A Checklist for the Night Before You Leave
- Confirm encryption and a strong passcode on your phone, laptop and tablet.
- Install operating system and app updates on everything you are taking.
- Set transaction alerts on your cards; add a travel notice if your bank provides one.
- Move two-factor codes off SMS where you can, and store recovery codes offline.
- Turn off notification previews on lock screens.
- Test your phone's hotspot so you are not learning it at the gate.
- Forget old Wi-Fi networks and disable auto-join.
- Back up photos and documents, so a lost device never means lost work.
- Pack a power bank and your own charging cable.
- Write down your bank's and card issuer's phone numbers somewhere other than the phone.
Nobody does all ten. Pick the four that match your trip, do them properly, and leave the rest for January.
Related Articles
