Secure connectivity abroad: how to reduce data risks while traveling

Travel increasingly means being connected almost all the time. Some people work from airports and hotels, others manage bookings, routes, and payments online, some move between countries as digital nomads, and almost everyone now handles personal and work-related tasks through digital services.

The smartphone has become the main gateway to banking apps, work email, messengers, documents, navigation, and ride-hailing services. At home, these actions usually happen within familiar infrastructure: a home network, a regular mobile operator, saved connections, and apps that have already been set up. On the road, those same actions often run through hotel Wi-Fi, open networks in airports and cafés, local mobile networks, and services that ask for access to location or other data. This expands the attack surface: users may have limited visibility into who handles their data and on what terms.

Travel eSIM services, such as Yesim, have become a practical alternative for travelers who need mobile data abroad. However, Wi-Fi in airports, hotels, and cafés remains a common option, even though this type of connection is not always secure.

Public Wi-Fi and hidden risks

People often choose public Wi-Fi by its network name. But the name alone does not prove that the access point is legitimate or that the connection is secure. That is why a routine connection to Wi-Fi in an airport, hotel, or café can be less safe than it appears.

The risk should not be overstated. Public Wi-Fi is safer today than it used to be: most websites use HTTPS, and many apps encrypt traffic. But that does not remove the issue entirely. Open and poorly protected networks can still be useful entry points for attacks, especially when users enter passwords, log in to work accounts, or send sensitive information over an untrusted connection.

One problem is that Wi-Fi names are not unique. They can be copied or made to look very similar to the network name of a hotel, airport, or café. To the user, it may look like a normal choice from the list of available networks, even though the device may be connecting through a fake access point.

When a Wi-Fi sign-in page opens after connection, the lock icon in the browser address bar and HTTPS at the beginning of the URL only show that the connection to that page is encrypted. They do not prove that the page actually belongs to the hotel, airport, or café. Fake login pages can use encryption too. The form itself deserves attention.

In 2024, the Australian Federal Police reported on a man who created fake free Wi-Fi networks in Australian airports and on domestic flights. Users connected to the network, saw a login page, and entered their credentials. Those usernames and passwords were saved by the attacker. He later accessed some users’ accounts and stole personal photos and videos, including material intended to remain private.

A seemingly ordinary connection to “free Wi-Fi” in a public place can therefore have more serious consequences than users expect.

A safer approach is to avoid entering anything on a Wi-Fi sign-in page that is not needed for standard guest access. Users should be cautious if a form asks for the password to an email or social media account, bank card details, an ID number, or asks them to install a separate app or configuration profile. After using public Wi-Fi, it is also better to remove the network from saved connections using “forget network” and disable auto-join or auto-connect for public networks to prevent the device from reconnecting without an explicit user action.

VPN: an additional layer of protection

A VPN is useful when a user has to rely on a network they do not control. It encrypts traffic between the device and the VPN server, which makes it harder for other participants on the same network to intercept or read data. This is especially relevant in airports, hotels, and cafés.

But a VPN does not remove every risk. It does not prove that a Wi-Fi sign-in page is genuine, does not protect against phishing, and does not override the permissions users grant to apps, such as access to location, photos, contacts, or other data. In some public networks, a VPN can also interfere with the sign-in page opening correctly.

A VPN should therefore be treated as an additional measure, not a complete privacy solution while traveling. It can reduce some risks on unfamiliar networks, but it does not remove them completely.

Apps and permissions

Once the user is online, the risk shifts from the network to the apps themselves. While traveling, users often rely on airline, hotel, mapping, ride-hailing, translation, and local delivery apps. A permission prompt may look like a technical formality, but it can open access to something specific: location, photos, contacts, the microphone, or other device data.

Not every permission is a red flag. A map app needs location, a taxi app needs a pickup point, and an airline app may need notifications for flight updates. The problem begins when the permission does not clearly match the function.

Apps also bring in third parties. They may include analytics tools, advertising SDKs, and other components. The user sees one interface, but the data may be processed by several parties.

Location data is especially sensitive. It can reveal a route, habits, and the context of a trip. There is also a less obvious mechanism: the advertising ID. It can be used to link activity, behavior, and location to a specific device. While traveling, this risk can grow: the more new apps and services a person uses, the more data collection points appear around a single smartphone.

In December 2024, the US Federal Trade Commission took action against Gravy Analytics, Venntel, and Mobilewalla, alleging that the companies collected and sold users’ location data without their consent.

Geolocation can reveal far more than a person’s route. Movement history can reveal where someone lives and works, which places they visit regularly, where they shop, which neighborhoods they spend time in, and what their daily routines look like. Even if the data does not contain a user’s name, the combination of these details can often be linked to a specific person and reveal far more about their habits and interests than they intended to share.

Many services collect this data for navigation or local recommendations, and also for advertising analytics. This data can be shared with partners and used to build a detailed user profile.

That is why app permissions should be treated as part of data security. If an app does not need precise location, contacts, photos, or microphone access to work properly, it is better to restrict that access. For example, users can allow location only while using the app, choose approximate location, or turn off unnecessary permissions in settings.

Local SIM or travel eSIM

Many travelers still choose a local SIM for mobile data abroad. From a privacy perspective, the process around local SIM purchase matters more than the plastic card itself: buying it on arrival, registering it, handing over documents, replacing the main SIM, and relying on a local seller or operator. In countries with mandatory prepaid SIM registration, the operator must verify and record customer data, so the connection can leave an additional administrative trail.

With a travel eSIM, the connection process looks different. In the case of Yesim, the user gets mobile data abroad through a Swiss eSIM provider. Only an email address is required for setup, with no passport details or other identification. For users, this reduces unnecessary offline steps: fewer interactions with unfamiliar points of sale, fewer documents involved in the setup process, and fewer decisions that have to be made after arrival.

Yesim also offers plan options that work through one eSIM for trips across several countries. Global Package and Global Plus Package are suitable for routes that cross borders: one plan covers multiple destinations, so the user does not need to buy a new local SIM every time. Pay & Fly works on a pay-as-you-go model and is also built around one eSIM. It can be used in 170+ countries, with users paying for the data they actually use. From a security perspective, the value lies in reducing repeated actions on arrival: fewer purchases from local sellers, fewer registrations in each country, and fewer situations where personal data has to be shared again.

Still, mobile networks process the technical data needed to keep the connection working. A travel eSIM mainly reduces the physical and administrative steps around connectivity and gives the user a more predictable way to get mobile data abroad.

There is also a physical security aspect. An eSIM cannot simply be removed from the phone if the device is lost or stolen. But that does not remove other risks: security still depends on device protection, accounts, passwords, apps, and how the user confirms sensitive actions.

The choice between a local SIM and a travel eSIM is therefore better understood as a question of control over the connection process. It does not guarantee absolute protection. New Yesim users can use the promo code GETYESIM15 for 15% off.

Bottom line

Secure travel connectivity means thinking through how the connection will work. The goal is to rely less on unfamiliar networks and avoid unnecessary data sharing where possible. This approach does not promise full anonymity and does not replace other security measures, but it makes connectivity more predictable.

Privacy while traveling comes down to specific actions: choosing the main way to go online, setting up mobile data in advance, checking permissions in important apps, and knowing when public Wi-Fi is better avoided. The fewer rushed decisions users make, the fewer opportunities there are for personal or work data to be exposed.