eSIMs, roaming and staying connected abroad

The security advice for travelling and the cheap advice for travelling point the same way, which almost never happens. Use it.

Why mobile data is the safe option

Hotel and airport Wi-Fi is a network you did not choose, run by people you cannot identify, shared with everyone in the building. Mobile data is a connection between your phone and a licensed operator, encrypted over the air by design.

If you only need to check something, turn Wi-Fi off and use data. It costs pennies now, and it removes an entire category of risk.

What an eSIM actually is

A SIM card as software. Instead of a plastic chip, your phone downloads a profile, usually by scanning a QR code. Any phone from roughly 2019 onwards supports it, and you can hold several profiles at once and switch between them.

For travel that means: keep your UK number active for calls and codes, and add a local data plan for the country you are in. Both at the same time, on one phone.

Buying one without getting stung

Buy from the provider's own website or app, found yourself. Airalo, Holafly, your own UK network, or the local operator. Never through a link in a search advert.

Scam eSIM sites are common, because it is a purchase made in a hurry, often at an airport, by someone who has never bought one before. The site takes the card details and sends nothing, or sends a profile that does not work.

Check the plan covers your country, not just the region. "Europe" sometimes excludes Switzerland or Turkey, which is where people get caught.

Install it before you fly, while you still have working internet. Activation usually needs a connection, which you will not have at the other end.

The two-factor trap

This catches people every trip. If your bank sends codes by SMS to your UK number, and you remove that SIM or disable roaming, you cannot receive them. You discover this when you try to pay for something.

Before you go:

• Keep the UK profile active for texts even if the data comes from a local plan.
• Better, move your important accounts to an authenticator app, which works with no signal at all.

There is more in two-factor authentication, ranked.

• Save recovery codes somewhere you can reach without your phone.

When you land

• Tell your bank you are travelling, or use the app's travel notification. Stops a legitimate

payment being declined.

• Check what your phone auto-joins. A remembered network name in one country is a spoofable name

in another.

• Check the VPN rules where you are going before you go rather than after. A small number of

countries restrict it — see are VPNs legal.

The travel scams to expect

The accommodation that wants a bank transfer. The taxi QR code. The "your booking needs reconfirming" email timed for the day you fly. And a text about a delivery you are not there to receive.

They work because you are tired, in an unfamiliar place, and dealing with genuine logistics. That is the whole design.