The Holiday Travel Security Kit: 4 Cheap Fixes

It's 11:40pm in a hotel somewhere in the middle of your holiday trip. The kids are asleep. You open your laptop, the hotel Wi-Fi list shows "Guest-WiFi" and "Guest_WiFi_5G," and a login page asks for your room number and your email.

One of those networks might not belong to the hotel at all.

I'll be honest: the odds that you personally get hit are low. But the fix for each of these problems costs less than the airport sandwich you're about to regret, and holiday travel is when we're all tired, rushed, and plugging things into whatever's closest. Scammers like that about us.

So this is a short kit. Four problems, the boring object that closes each one, and an honest note on what it won't do.

Problem one: the Wi-Fi you can't verify

Here's the move. A scammer sets up a hotspot near a hotel or airport and names it something plausible. Your phone or laptop connects. A login page pops up asking for an email, a room number, maybe a card "to verify your stay." Everything you type goes to the scammer. This is usually called an evil twin network, which sounds like a soap opera because it basically is one.

The hotel's real Wi-Fi has a different problem: it's shared. Every guest on the floor is on the same network as you, and you have no idea what's on their laptops.

The FTC has long advised being careful with public hotspots and looking for HTTPS and a WPA password before you trust one. That's still sound advice, and it's also a lot to ask of someone at midnight.

The object: a travel router. It connects to the hotel network once, then broadcasts your own private network that only your devices join. Your phone, laptop, and tablet stop talking directly to the hotel Wi-Fi, and the router can run a VPN for all of them at the same time.

What it won't stop: a fake login page that you type a password into. If you hand the scammer your credentials, the router can't un-hand them. It also won't help if the router itself is joined to the wrong network, so confirm the Wi-Fi name with the front desk before you connect it.

For anything involving money, switch to cellular data. It's boring, it works, and no router is required.

Problem two: the USB port that's more than a charger

You're at 3% in an airport and every outlet is taken. There's a USB port in the wall of the seating area. Power, right there.

A tampered public port can try to talk to your phone, not just charge it. I wrote the full breakdown in the juice jacking post, including what the actual research shows and how rare real-world cases are. Short version: it's probably not happening to you, and the fix is still a few bucks.

The object: a USB data blocker. It's a tiny adapter that passes power and leaves out the data pins. Put it on your keychain so it's there when you're stuck at 3%.

What it won't stop: a malicious cable someone hands you, or a compromised charger you own. If it's yours and you trust it, you're fine. If a stranger offers you a "spare cable," politely decline.

Problem three: the phone you can't trust anymore

This one's not about prevention. It's about what to do in the first hour after something goes wrong.

Say you clicked a link in a text that looked like a hotel-booking confirmation, or approved a pairing request you didn't understand. Now you're traveling, you're nervous, and you're about to use that same phone to check your bank balance. Don't.

The object: a Faraday bag. It blocks all signal to whatever's inside, so you can park a phone you suspect is compromised while you figure out your next step from a different device. The same bag is also handy for spare key fobs, and the one in our shop is fireproof and water-resistant, so it doubles as a safe spot for your passport and cards in the hotel room.

What it won't stop: the scam itself. A Faraday bag is a pause button, not a shield. If something bad already happened, the real work is changing passwords from a clean device and calling your bank. Our guide to what to do after you click a scam link walks through it.

Problem four: cards and a passport in a coat pocket

RFID-blocking sleeves are the most over-sold item in travel. Let me be straight: I can't point you to a stack of documented cases of someone skimming a passport out of a crowded lobby. A sleeve is cheap, it keeps cards from rattling around, and I like it. I just won't tell you it's saving your life.

The same goes for contactless cards. Sleeves are low-drama insurance, not the main event.

The kit, packed

If you'd rather grab everything in one go, the Cautellus shop has these items grouped as the Frequent Traveler Bundle: travel router, USB data blocker, RFID card and passport sleeves, and the Faraday bag. Nobody needs all four to take a trip. If you pick two, I'd pick the router and the blocker.

The scams a kit can't touch

Gear fixes the technical stuff. It does nothing about the con itself, and holiday travel has plenty:

• A text from your "hotel" asking you to confirm a payment. Real hotels rarely text you a payment link out of nowhere. Compare it to the booking confirmation you actually have. The reservation hijack scam works exactly this way, and it's why I tell people to call the number on the confirmation, not the one in the text.
• A parking-meter or luggage-tag QR code. Scammers love stickers. If the code sits on top of another sticker, don't scan it.
• A too-good-to-be-true rental or flight deal. The summer travel scams guide covers the usual suspects. They don't take the winter off.
• Any message that makes you rush. A scammer's favorite thing about travel is that you're already tired and on a clock.

If a message about your trip shows up and something feels off, you can run it through our text message checker. You get one free trial scan every 30 days, no card needed. Beyond that, continued use is part of Cautellus Plus, which is $9.99/mo. And if the message is the kind of thing that's been going around lately, our text message scams hub shows the patterns we see most.

If something already went wrong on the road

No shame. You were tired and the scammer was prepared. Do this, in order:

1. Disconnect from the network and put the phone in airplane mode.
2. From a different device or connection, change the password for email first. Everything else resets through email.
3. If you entered a card number on a login page, call the number on the back of the card and tell them.
4. Turn on a hardware key or app-based two-factor login for the accounts that matter once you're home.
5. Report it at reportfraud.ftc.gov when you have a minute. It helps.

Frequently Asked Questions

Is hotel Wi-Fi actually dangerous, or is that overblown?

Both. Most people connect to hotel Wi-Fi every trip and nothing happens. The risk is that you can't tell the real network from a lookalike, and you're sharing the connection with every other guest. A travel router doesn't make hotel Wi-Fi trustworthy, it just stops your devices from sitting directly on it.

Do I need a VPN if I have a travel router?

A travel router gives your devices their own private network behind the hotel's, and the one we list supports VPN connections. If you already use a VPN you trust, set it up on the router once and every device you travel with is covered. If you don't use a VPN, the router still keeps your devices off the shared hotel network.

Will a Faraday bag stop someone from stealing my passport information?

Treat it as cheap extra protection, not a fix for a common attack. I can't point you to a pile of documented passport-skimming cases. Where a Faraday bag earns its place is isolating a phone you think is compromised, shielding a key fob, and keeping documents dry and fire-resistant in a hotel room.

What should I do if I already connected to a suspicious Wi-Fi network?

Disconnect and forget the network. Then, from a different connection like your phone's cellular data, change the password on anything you logged into while connected, starting with email and banking. If a login page asked for a card number, call your card issuer and tell them.

Is this travel kit only for holiday trips?

No. The attacks don't care what month it is. I'm writing about it now because holiday travel packs airports and hotels with people in a hurry, which is exactly the situation these tricks rely on.

One thing to do tonight

Before you pack, put the USB data blocker on your keychain and set up the router once at home, so you're not figuring it out at midnight in a hotel room.