Holiday Without a Data Leak: What Is Actually Dangerous on the Road, and What Is Just Panic

Sabine is on holiday. Two weeks at Lake Garda, a flat booked through Booking, all sorted. At Munich Airport her phone is down to 4 percent. Right by the gate there is a charging pillar with USB ports. Sabine eyes it like it might bite. Didn't someone in the family group chat say airport chargers hack your phone? So she lets the battery die a hero's death and boards the flight to Verona with a black screen. Safety first.

On the beach at Bardolino she posts story after story: "14 days of sun, the house can look after itself!", location tag included. That evening a message from the flat pops up in the Booking app: her credit card could not be verified, please confirm via this link within 12 hours or the booking will be cancelled. Name correct, booking number correct, dates correct. Sabine types in her card details. Two days later someone in Singapore buys 1,400 euros worth of electronics. Spot the irony? Sabine dodged the decoy and walked straight into the trap.

That is what this Survival Kit is about: which travel risks are real, which ones you can relax about, and what to actually do before, during and after your trip. No tinfoil hat required, just a plan.

Myth check: what you can relax about

Juice jacking: the charger that (almost) never bites

Juice jacking is the idea that tampered USB charging ports secretly pull data off your phone or install malware while it charges. In 2023 even the FBI warned about it. The catch: there is still no documented, confirmed attack in the wild. In 2025, 86 security leaders, including the former director of the US cybersecurity agency CISA, put juice jacking on their list of outdated security myths in an open letter.

It is not pure fiction, though. In 2025, researchers at Graz University of Technology showed with "ChoiceJacking" that a rigged charger can pull data from Android and iOS devices in the lab, but only while the screen is unlocked. Apple fixed this in iOS 18.4; on Android it depends on your device's updates. That is why the BSI, Germany's Federal Office for Information Security, still advises avoiding public USB ports and strangers' cables.

The sensible middle ground: your own charger in a regular socket, or a power bank. If it has to be a USB port, keep the phone locked, and if it asks "Trust this computer?", tap no. For total peace of mind, a USB data blocker costs a few euros and lets power through and nothing else. Just do not fly off with a dead battery like Sabine: in an emergency, a dead phone is worse than any charging station.

Hotel and airport Wi-Fi: from bogeyman to mild nuisance

Open Wi-Fi used to be a free-for-all. Today practically every website and app uses HTTPS, so traffic is encrypted. Someone snooping on the hotel network can usually see which services you connect to, but not what you type there. The remaining risks are more con artist than hacker:

• Fake hotspots with trustworthy-sounding names like "Hotel_Guest_Free". Ask reception for the exact network name.
• Nosy login pages: room number and surname are normal, credit card details for "free" Wi-Fi are not.
• Never click past browser certificate warnings. Back out instead.

Often the best fix: within the EU, "Roam like at home" lets you use mobile data on your home plan's terms, which is more convenient and safer than hotel Wi-Fi. In Switzerland or Turkey the EU rule does not apply, though, and roaming can get expensive fast.

VPN: an umbrella, not a hazmat suit

A VPN (virtual private network) builds an encrypted tunnel from your device to the VPN provider's server. The BSI recommends one for public networks, and it is worth it if you spend a lot of time on other people's Wi-Fi or work while travelling. What it cannot do: protect you from phishing or lock your stolen phone. It also just moves your trust around, because now the VPN provider is watching instead of the hotel. Free VPNs that live off your data are more risk than protection.

The real holiday traps

Now for the things that actually cost money and nerves. Spoiler: almost all of them run on deception, not technology.

The Booking message that is not from your hotel

This is Sabine's trap, and it is nasty because it arrives through the real channel. German consumer advice centres (Verbraucherzentralen) have been warning about it for years: scammers write via the Booking chat or WhatsApp, know your name, booking number and dates, and ask you to "verify" your card or face cancellation. The link leads to a convincing copy of the Booking site.

Where does the real data come from? Usually the property itself. Back in 2023, Booking.com said that staff at properties had lost their logins to phishing, and in 2025 Microsoft described a campaign that baited hotel staff with fake Booking emails carrying malware. Once the hotel account is hijacked, the message technically comes from the real sender. There is just the wrong person at the keyboard.

Your rules:

• According to the consumer advice centres, Booking.com never asks for card details by email, chat, text, WhatsApp or phone.
• Pay only through the platform's own payment function, never through a link in a message. If possible, choose "pay at the property".
• Time pressure is the classic red flag. "Within 12 hours or we cancel" translates to: please do not think about this.
• When in doubt, call the property using the number on its official website, not the one in the message.

Fake holiday rentals: dream view, nightmare host

Lake view, pool, peak season, half the price of everything nearby and still available? Congratulations, you have probably found a ghost listing. Typical warning signs according to the European Consumer Centre Germany (EVZ): full prepayment by bank transfer, often with a "discount for paying now", a host who wants to chat or get paid outside the platform, just an email address instead of a name and address, and a request for a copy of your ID.

What helps: run the photos through a reverse image search. Pay only through the platform, ideally by credit card, and pay at most a small deposit of around 20 percent up front. In Italy and Spain, hosts also need a registration number, which can sometimes be checked in official registers.

Quishing: when the QR code is a sticker

Quishing is phishing via QR code. At parking meters in Hannover, for example, scammers stuck their own QR codes over the real ones from the payment service EasyPark. Scan it and you land on a fake page that happily takes your card details. The same trick has turned up on electric car chargers.

• Look and touch: is the code a sticker, crooked, or stuck over another one? Hands off.
• Read the address in the preview before opening it. Typos or unfamiliar domains are a clear no.
• Better to download the parking or charging app straight from the official app store. According to EasyPark, its real codes open the app anyway, not a card form.
• Does an add-on device at a parking meter suddenly want your PIN for a contactless payment? Cancel. Exactly these devices were found in Cologne and Hanau.

Rental cars: the scratch that arrives by email

A real headache is damage claims after the fact for scratches nobody saw. The EVZ recommends filming a walk-around video at pickup and return, interior included, and returning the car during opening hours with a staff member present rather than using a key drop box. If a claim arrives anyway, dispute it in writing, ask for evidence and check whether a credit card chargeback is possible. Never pay a "damage invoice" through a link in an email; check it in your customer account instead.

Live holiday photos: an open invitation

Sabine's "14 days away!" story with a location tag is more useful to burglars than a note on the front door. The BSI advises sharing holiday photos, locations and automatic out-of-office replies sparingly and posting pictures after you get back. The sunset over the lake will look just as good next week.

Pickpocket plus passcode: the jackpot

Things get expensive when the thief and your passcode meet. Someone at the beach bar watches over your shoulder (shoulder surfing) while you type your code, then grabs the phone later. Without extra protection, the passcode is enough to change account passwords. So in public, use Face ID or your fingerprint and shield the code with your hand.

Before you leave: pack your digital suitcase

Most of your security gets packed at home. Set aside half an hour, ideally before the frantic search for your swimsuit:

1. Back up. iPhone: Settings > [your name] > iCloud > iCloud Backup. Android: search the settings for "Backup".
2. Install system and app updates. At home on Wi-Fi, not at the gate.
3. Check your screen lock: at least six digits, no birthday, no 123456.
4. Turn on your SIM PIN. iPhone: Settings > Mobile Service (Cellular in some regions) > SIM PIN. Android: search the settings for "SIM lock". The initial PIN is in your contract documents. Do not guess, or the SIM gets locked.
5. Turn on theft protection. iPhone: Settings > Face ID & Passcode > Stolen Device Protection (newer iOS versions enable it automatically, but check anyway). Android: Settings > Google > All services > Theft protection, then enable "Theft Detection Lock" and "Offline Device Lock".
6. Test tracking. iPhone: under Settings > [your name] > Find My, "Find My iPhone" must be on. Then hit "Play Sound" once at icloud.com/find on your laptop. Android: same thing at google.com/android/find (Find Hub, formerly Find My Device). If it does not work at home, it will not work at Lake Garda either.
7. Secure your accounts: email first, then your booking platform, bank and Apple or Google account, each with multi-factor authentication (MFA) or passkeys. Passwords belong in a password manager, not in your notes app.
8. Write an emergency list, on paper and with someone you trust at home: Germany's card-blocking hotline (Sperr-Notruf) 116 116, from abroad +49 116 116, fallback +49 30 4050 4050. Add your IBAN, your mobile provider's hotline and your phone's IMEI (its serial number; dial *#06# to see it).
9. Travel light: bring only the devices you really need. Nobody needs the work laptop on the beach.

On the road: small habits, big payoff

Paying: plastic beats a wad of cash

A fat wad of cash is a pickpocket's favourite: anonymous and gone for good. Cards or phone payments are usually the better choice, especially since Apple Pay and Google Pay do not transmit your real card number, but a stand-in code (a token).

Outside the eurozone, say in Switzerland, Czechia or Turkey, watch for the conversion trap: the ATM or card terminal offers to charge you in euros right away. Sounds convenient, but in a spot check by Stiftung Warentest, Germany's consumer testing foundation, it cost up to 13.7 percent more. Always choose the local currency. At ATMs, prefer one at a bank branch, cover the PIN pad, and walk away if the card slot wobbles.

Wireless off when you do not need it

On the beach, unsolicited pictures from strangers are rarely good news. iPhone: Settings > General > AirDrop > "Contacts Only" or "Receiving Off". Android: set Quick Share visibility in quick settings to contacts only. According to the BSI, Bluetooth, NFC and Wi-Fi are best switched on only when you need them. And the guest PC in the lobby is for printing boarding passes, not for online banking.

If something goes wrong: the emergency plan

Phone gone

1. From another device, log in at icloud.com/find (iPhone) or google.com/android/find (Android) and mark the device as lost. That locks it.
2. Do not remove the device from Find My or your account, or Activation Lock goes away. Only erase it remotely once all hope is gone.
3. Have your SIM blocked through your provider or the 116 116 hotline.
4. Report the theft to the local police, with the IMEI. Your insurer will want the report too.
5. Change the passwords for email, banking and messengers and sign the device out there.
6. Ignore texts saying "Your iPhone has been found". That is phishing aimed at your Apple ID. Apple says it never contacts customers by text or email about a found device.

Card gone or a strange charge

Block it right away: 116 116, from abroad +49 116 116, or if that fails +49 30 4050 4050, with your IBAN at hand. Many banking apps can do it at the tap of a button too. Then contact your bank, because unauthorised charges can often be reversed, and file a police report. Back in Germany, for online fraud you can also use your state police's online reporting portal (Onlinewache).

Entered your details

Typed your card details into a fake page? Call your bank, block the card, report it to the police: that is the order the consumer advice centres recommend. Then tell the platform so it can shut down the hijacked hotel account. For disputes with companies elsewhere in the EU, the EVZ helps free of charge.

Checklist

• Backup and updates done
• Screen lock with at least six digits, SIM PIN on
• Theft protection on, tracking tested
• MFA on email, booking platform, bank and Apple or Google account
• Emergency list on paper: 116 116, +49 116 116, IMEI, bank hotline
• Own charger and power bank in your hand luggage
• Pay for accommodation in the app only, never via links in messages
• Outside the eurozone: always the local currency
• Holiday photos posted after you get home

Bottom line: fear the right things

Sabine got her 1,400 euros back, by the way, because she reported the charge to her bank straight away. The airport charger would never have hurt her; the message in the app did. Next holiday she charges at the gate with her own plug, posts the beach photos from her sofa and simply calls the hotel when a message smells fishy. She still needs a holiday from her holiday.

Your trip does not need a tinfoil hat. It needs half an hour of prep and a healthy distrust of anything that rushes you. So pack the suitcase, pocket the emergency list, and before you head off: Turn on MFA. Think purple.