Cybersecurity for digital nomads: protect your freedom wherever you roam

Why cybersecurity for digital nomads is different

Working on the road means freedom, but it changes your risk in three ways. You rely on networks you do not control: hotel Wi-Fi, coworking spaces, airports. Your devices are physically exposed in hostels, trains and on beaches. And if something goes wrong, you face it alone: no IT desk, and often a time zone where your bank is asleep.

Handling client data? Protecting it is your responsibility, wherever your next adventure takes you.

The good news? The tools are better than ever. Forget paranoia. Build your setup once, let it run in the background, and focus on the freedom you came for.

Protect your digital life: passkeys, 2FA and a password manager

Put passkeys first. Shut phishing out. A passkey is a cryptographic key pair tied to a service's real web address. It works only on the genuine site: it cannot be typed in, shared or entered on a phishing page. The US standards body NIST treats passkeys as phishing-resistant in its digital identity guidelines (SP 800-63B). Almost every current phone and laptop can create them. If a service offers a passkey, take it. Your accounts deserve that protection.

Keep a password manager. Guard your master key. Many services still need passwords. A manager creates a unique password for each, stores your passkeys across devices and warns you about known breaches. Protect the manager itself with a strong second factor. This is your master key. Treat it like one.

Choose your second factor before someone exploits it. Codes sent by text message are the weakest option. SIM swapping, where attackers move your number to their own SIM, and real-time phishing both defeat them, and NIST lists SMS as a restricted method. Put protection in the right order: passkey or hardware security key, then authenticator app, then SMS. Travelling abroad? Text messages to your home number do not always arrive. An authenticator app works offline. Don't leave access to chance.

Nomads: don't let these three details become painful regrets:

• Keep recovery codes for your key accounts offline and away from your devices, for example, printed in your document pouch.
• Where possible, set up a second factor on a second device. Losing your phone should not mean getting locked out.
• Learn how to sign out of all active sessions on your main accounts now, not when you desperately need to.

Public Wi-Fi and VPNs: what still matters

That cafe Wi-Fi feels like a lifesaver, but can you trust it? Since almost all web traffic now runs over HTTPS, someone on cafe Wi-Fi can no longer simply read your passwords. Breathe easier: the risk is smaller, not gone.

What still puts you at risk? Fake hotspots with trustworthy names, manipulated login portals, metadata about the services you use, and apps or old devices that still send data unencrypted. Don’t leave yourself guessing: our guide to public Wi-Fi security when traveling goes deeper.

A VPN deals with exactly what remains. It builds an encrypted tunnel from your device to a VPN server, so nothing on the local network can be read and the Wi-Fi operator cannot see which services you use. That’s protection worth having, and limits worth knowing. You move trust from the cafe to the VPN provider, and a VPN does not make you anonymous or protect you from phishing or malware. Choose a provider whose business model you understand, and switch it on before you join an open network.

Take back control with three everyday habits:

• Keep your operating system and apps up to date.
• Guard your sensitive moments: do banking and other sensitive tasks over your own mobile connection, not public Wi-Fi.
• Turn off automatic joining of known networks, so your device does not connect to a fake hotspot with the same name.

Backup connections: your internet is part of your security

Lose your connection, and you lose more than internet access. You cannot take a client call, approve a login or locate and wipe a stolen device. Security means staying connected when it matters. Connection redundancy belongs in every security setup, next to the VPN and the backup.

Do not let a rural escape become a connection nightmare. In Italy, for example, Rome and Milan have fiber and 5G, but many villages still rely on old copper lines too slow for video calls. Coverage also varies widely between villages and local carriers. Before you book, check carriers' coverage maps for the exact address, not just the region.

Your key tool? The eSIM: a built-in SIM profile you activate in minutes with a QR code. Know the three types:

• Local prepaid plans from a carrier in the country: usually your best network and best price per gigabyte, with some setup in each country.
• Travel eSIMs for one country or region: booked in minutes, with no contract, ideal for short stays. Many are data-only, with no phone number.
• Roaming on your home plan: convenient, but usually subject to fair-use limits that are not meant for months of work abroad.

Keep your essential codes within reach. Many long-term travelers use a dual SIM approach: their home number stays active for bank codes and account checks, while a local or regional data profile handles everyday traffic.

Do not leave your work depending on a single connection. Redundancy means two ways online through two different carriers: if the Wi-Fi fails, your phone becomes a hotspot. Working somewhere truly remote, for example from a van? Add satellite internet as a third layer.

Do not risk losing access to important accounts. With data-only eSIMs, keep your home number active while any important account still sends SMS codes to it, or, better, move those accounts to app or passkey sign-in before you leave.

Devices and backups: encryption plus 3-2-1

Your device could disappear in seconds. Don’t let your private data go with it. Built-in tools are enough; you just have to turn them on. Current operating systems include full-disk encryption; on phones, it’s standard once you set a screen lock. A stolen device becomes a useless brick, not an open filing cabinet. Set a short auto-lock time, and be careful with unknown USB sticks and charging cables.

Losing your backpack is painful. Losing your work too? That’s what the 3-2-1 rule helps prevent: three copies of your data, on two different types of media, one of them in another place. For nomads, it’s simple: your working copy on your laptop, an encrypted external SSD in your bag and a cloud copy that survives even if your whole backpack disappears.

Turn “I hope it’s safe” into action with three steps:

1. Automate. Let cloud sync and laptop backups run in the background.
2. Encrypt. Encrypt your external SSD. Use end-to-end encrypted cloud storage or encrypt sensitive client files before they leave your laptop.
3. Test the restore. Don’t wait for disaster to discover what’s missing. A backup you have never restored from is a rumor, not a backup.

When a device goes missing

Prepare: protect yourself before panic strikes. Turn on your operating system's find-and-wipe feature. Keep important numbers offline on paper: your bank's emergency line, your card issuers' lost-card numbers and your devices' IMEI numbers. Keep a second device, even your old phone, with access to your password manager and a second factor.

If it happens, take back control, in this order:

1. From your second device, protect what matters most: secure email and banking first, change passwords, sign out all sessions.
2. Have your SIM or eSIM blocked to stop anyone intercepting your SMS codes.
3. Locate the device, then wipe it remotely. Once wiped, it can no longer be located, so only take this step when you have given up on it.
4. Report the theft to the local police; insurers usually want the report.
5. Keep your guard up: watch for phishing that refers to the lost device in the following days.

With encryption, passkeys and current backups, losing your device means an expense, not a disaster.

The legal side: protect your data, and your freedom

Working anywhere is a dream, but protecting your clients’ personal data is a responsibility you take everywhere. If those clients are in the EU, the GDPR applies wherever you work from. You remain responsible for encrypting stored data, transferring it securely and avoiding services with no legal basis for processing it. Check local data protection rules too: some countries are stricter than the EU, others much looser.

Your business, without borders: Estonia's e-Residency program lets you run an EU company with European data protection standards from anywhere.

Your next chapter deserves solid legal ground. Residence rules have matured, and many countries now offer digital nomad visas, typically requiring minimum income, health insurance and proof of work. For non-EU citizens, the Schengen rule still applies: 90 days in any 180-day period.

Choose coworking for internet and power that are usually more stable than a cafe’s, but don’t let your guard down. You still don’t control those networks: your VPN and device rules apply there too.

Frequently asked questions

Do digital nomads need a VPN?

Hotel and cafe Wi-Fi should connect you, not leave you feeling exposed. A VPN helps on networks you do not control, encrypting your traffic to the VPN server and hiding which services you use from the Wi-Fi operator. Take more control of your connection, but remember: it does not make you anonymous or protect you from phishing or malware.

Is public Wi-Fi safe for digital nomads?

Your freedom shouldn’t cost you your peace of mind. Public Wi-Fi is safer than ten years ago, because most traffic runs over HTTPS. But fake hotspots, manipulated login pages and unencrypted apps still pose risks. Protect what matters: use a VPN, keep devices updated and do banking over your own mobile connection.

What should I do if my laptop is stolen abroad?

Your laptop is gone, but you can still take control. From a second device, secure email and banking first, then block your SIM. Locate the device and wipe it remotely once you give up on it. Report the theft to the local police, and stay alert for phishing in the following days.