A calm, practical playbook to keep your brokerage accounts and crypto safe while you travel. No fear-mongering—just the threat model, the controls that actually work, and copy-paste checklists you can use before wheels-up and after wheels-down.
Threat model on the road: theft, SIM-swap, phishing
Life on the move increases exposure. You change networks, borders, devices, and routines; every change is a chance for an attacker (or simple bad luck) to get a foothold. Start by naming the big four threats and how they actually bite.
1) Physical theft/loss. Your backpack disappears, your phone gets snatched, or your laptop is “helpfully” taken during security screening. If your device isn’t disk-encrypted, the thief owns your saved logins, mail, and notes (which often contain reset links and recovery phrases). Even with encryption, poorly configured lock screens and notification previews leak one-time codes and sensitive mail.
2) SIM-swap and phone-number takeover. Attackers socially engineer your carrier to “port” your number to their SIM, intercepting SMS 2FA and password resets. If your broker still allows SMS-only 2FA, a SIM-swap can mean same-day account takeover. Nomads are at higher risk because of roaming, local SIMs, and carrier changes that add noise to your profile.
3) Phishing (classic and MFA-prompt fatigue). Travel means public Wi-Fi, airport lounges, late-night logins, and rushed decisions. That’s the ideal environment for look-alike domains, QR-code bait, “urgent compliance” emails, and MFA-bombing (spamming push prompts until you tap “Approve”). If you reuse passwords or lack phishing-resistant 2FA, one click can escalate.
4) Untrusted networks and malware. Captive portals and mall Wi-Fi sit between you and the internet, injecting scripts and harvesting logins. Shared machines (hostels, coworking) are minefields: keyloggers, poisoned extensions, and clipboard hijackers. A single infected plugin in your main browser profile can man-in-the-middle your session cookies.
Mitigation mindset:
- Assume devices will be lost and numbers will be stolen; design access so that neither grants entry.
- Make your second factor truly second (not SMS).
- Keep broker and wallet operations to a clean device/profile and known networks.
- Pre-stage recovery paths that work without your phone.
Accounts: passwords, 2FA apps vs hardware keys
Good authentication wins 80% of this battle. Treat account security like a system: strong secrets, phishing-resistant factors, and a recovery plan that works when your phone and number are gone.
Password discipline
- Use a reputable password manager with cloud sync and local unlock via long master passphrase (+ device biometrics).
- Generate unique 20–32 char passwords for every service; never reuse across broker, email, crypto, or cloud storage.
- Add a second, offline backup of the master passphrase (sealed envelope or metal plate, stored separately from devices).
2FA matrix (good / better / best)
| Area | Good | Better | Best |
|---|---|---|---|
| Second factor | TOTP app (e.g., Aegis, Authy) | TOTP on separate device + backup codes | Hardware security keys (FIDO2/WebAuthn) + offline TOTP print |
| Delivery | App-based codes | App + number-locked SIM | Two hardware keys on different keyrings |
| Broker recovery | Email + ID check | Recovery codes stored offline | Pre-registered backup key + withdrawal whitelist |
| Admin email | Strong password only | Email with app 2FA | Email bound to hardware key only |
Recommendations
- Prefer hardware security keys (FIDO2/WebAuthn) wherever supported by your broker/exchange and admin email provider. Register two keys: one you carry, one in a safe place at home.
- If keys aren’t supported, use a TOTP app (not SMS). Back up the TOTP seeds at enrollment (paper or encrypted file) so a lost phone doesn’t lock you out.
- Disable SMS 2FA where possible. If you must keep it, activate your carrier’s number lock / port freeze and set a port-out PIN.
- Create withdrawal whitelists (addresses/accounts in your name only) and set cool-off timers for new beneficiaries.
- Turn on login alerts, new device alerts, failed login alerts, and withdrawal alerts for broker and exchange accounts. Route them to two channels (email + app).
Recovery hygiene
- Print backup codes and store them offline.
- Document your support workflow (exact answers, ID docs required).
- Keep a spare authenticator device pre-enrolled (old phone kept at home, powered off).
Devices: updates, disk encryption, travel laptop/phone
Devices are your keys to the kingdom. Harden them so that loss or seizure is an inconvenience—not a catastrophe.
Baseline configuration (laptop & phone)
- Full-disk encryption: On by default in iOS and modern Android; on macOS (FileVault) and Windows (BitLocker—use Pro where possible). Record your recovery keys offline.
- Auto-lock at ≤60 seconds; require passcode/password (not just biometrics) after short idle or after restart.
- Minimal install: A dedicated travel profile or machine with only what you need (broker app, authenticator, secure browser). Fewer extensions, fewer attack surfaces.
- OS & firmware updates: Apply before each trip and during long stays. Enable automatic updates (but don’t update seconds before a flight—test first).
- Secure boot and TPM (Windows) / T2 (Mac).
- Anti-theft: Enable Find My (Apple/Google) and know how to remote wipe.
Travel laptop vs daily driver
- Consider a travel laptop with no source code, no client docs, and only travel accounts. If it’s seized or lost, your blast radius is tiny.
- On your primary machine, create a separate OS user (“Travel”) with limited privileges. Use that user for all broker/crypto sessions.
Travel phone strategy
- Use an eSIM primary and a physical SIM as backup, both with carrier locks and port-out PINs.
- Install only essential apps; disable notifications on the lock screen for mail/2FA.
- Keep an offline copy of critical docs (PDFs encrypted with a known passphrase) for airport Wi-Fi limbo.
Peripheral security
- Carry a USB data blocker (charge-only) for public USB ports.
- Don’t pair to unknown Bluetooth devices.
- If you must print or scan, prefer reputable business centers; log out and clear history.
Operational habits
- Never leave devices unattended in rooms without room safes you trust (and remember: many are pickable). Use a cable lock in cafes; sit with line-of-sight.
- Power down fully (not just sleep) when crossing borders or leaving devices in storage.
Networks: hotspot vs public Wi-Fi, VPN hygiene
Your network is the road you drive on. Choose roads you control and keep them clean.
Preferred order of access
- Personal hotspot from your phone (trusted carrier).
- Private Wi-Fi you control (apartment/host’s router you can reboot/configure).
- Public Wi-Fi (airport/cafe/coworking) as last resort.
When you must use public Wi-Fi
- Treat it as hostile. Assume traffic is being inspected and captive portals can inject scripts.
- Use a reputable VPN to encrypt traffic—but don’t let a VPN become a crutch. A VPN doesn’t make phishing safe, and it won’t fix malware on your device.
- Validate the SSID with staff; beware evil-twin networks (same name, rogue AP).
- Turn off auto-join and network discovery; enable firewall (block incoming).
- Use HSTS-enforced sites (your broker should be) and never bypass certificate warnings.
VPN hygiene
- Pick a provider with a solid track record, native apps, and kill-switch.
- Don’t chain random free VPNs. If corporate VPN is available, use that for work; for broker access, your personal VPN is fine as long as it doesn’t trip your broker’s fraud controls.
- Some brokers flag anomalous IPs. If your login fails with VPN on, try a different endpoint or temporarily use your cellular hotspot.
Browser profile
- Create a dedicated “Finance” browser profile: no personal extensions, no shopping, no random browsing. Bookmark only broker/exchange/admin email.
- Disable third-party cookies; clear site data after sessions. Consider container tabs or temporary containers.
DNS & extras
- If you know how, use encrypted DNS (DoH/DoT) to reduce leakage.
- Don’t install browser extensions abroad; many are Trojan horses for your session cookies.
Brokerage: recovery codes, alerts, support workflows
Brokers vary, but you can standardize your setup so account takeover attempts hit a wall.
Lock tight the front door
- 2FA: Prefer hardware keys (two registered). If unsupported, TOTP app; never SMS-only.
- Withdrawal whitelist: Enable it. Add only your personal bank accounts; lock down the ability to change the whitelist with a cool-off period (e.g., 48–72 hours).
- Trading PIN: If offered, set a separate PIN required for orders/withdrawals.
Watch the windows
- Enable alerts for: new device/login, failed logins, password/2FA changes, beneficiary changes, withdrawals, and large orders.
- Route alerts to two channels (admin email + authenticator app). Consider a secondary email at a different provider as a failover.
Support workflow
- Create a one-pager with: your account numbers, support phone/email, the security questions you set, and the exact documents they will ask for (passport, address proof). Store offline and in an encrypted vault.
- Know the account freeze phrase: what to say to support to temporarily lock trading/withdrawals if you suspect compromise.
- Test the callback process once (non-urgent) so you know the rhythm and country codes.
Audit cadence
- Quarterly: review authorized devices, active API keys, and open sessions; terminate anything unfamiliar.
- Yearly: rotate passwords, refresh W-8BEN or equivalents, and reconfirm beneficiaries.
- After any travel stint: check login history and security settings before resuming normal trading size.
Crypto: hardware wallets, seed handling, border considerations
Crypto is bearer-style risk: whoever controls the private keys controls the funds. Nomads must plan for confiscation, coercion, and accidental disclosure—not only for hacks.
Custody model
- For long-term holdings, prefer a hardware wallet with BIP39 seed you generated offline. Keep a watch-only wallet on your phone to check balances without exposing keys.
- For active use, a hot wallet with small, expendable balances is acceptable. Treat it like cash in your pocket.
Hardware wallet hygiene
- Buy direct from the manufacturer; verify tamper seals/attestations.
- Initialize offline; record your 24-word seed on archival paper or metal. Never photograph or store the seed in cloud notes.
- Consider a passphrase (25th word) to create a hidden wallet; memorize the passphrase separately from the seed.
- Test recovery on a spare device (or a wiped test wallet) before travel.
Seed handling & backups
- Store two sealed copies of the seed in separate locations (different cities/houses).
- If traveling long-term, carry no seed; instead, rely on your hardware device with PIN and the knowledge that you can recover from the backups if the device is seized.
- If you must carry a seed, use a decoy/duress setup (a low-value wallet via passphrase) and keep real value in a different derivation path.
Border considerations
- Some jurisdictions may treat seed phrases or hardware wallets as declarable assets or demand device unlocks. Reducing what you carry minimizes coercion risk.
- Keep the device powered off crossing borders; lock with long PIN and brick on wrong tries if supported.
Withdrawals & whitelists
- On exchanges, enable address whitelists and withdrawal locks.
- Move profits regularly to cold storage; don’t let balances accumulate in hot wallets or exchanges you just met abroad.
Learning paths & comparisons
- For a structured primer, see “Criptomonedas para novatos” (Spanish, 24x.es): https://24x.es/criptomonedas-principiantes
- For device trade-offs, see “Ledger vs Trezor” (Spanish, 24x.es): https://24x.es/ledger-vs-trezor
Pre-travel and Post-travel Checklists (Downloadable)
Pre-travel (do these 7–10 days before departure)
- Update & encrypt: OS, browsers, broker apps; confirm FileVault/BitLocker and phone encryption are on; record recovery keys offline.
- 2FA hardening: Register two hardware keys (or TOTP with offline backup); disable SMS 2FA where possible; set carrier port-out PIN and number lock.
- Admin email isolation: Create a finance-only email bound to hardware keys. Move broker/exchange logins to it.
- Broker controls: Turn on withdrawal whitelists, cool-off timers, and alerts; print backup codes.
- Device minimalism: Create a travel user (or travel laptop/phone). Install only essentials. Prepare USB data blocker.
- Docs & funds: Prepare ID, PoA, and support script. Pre-fund brokers/exchanges so you don’t need to wire from sketchy networks.
- Wallet sanity: Test hardware wallet PIN, confirm watch-only app shows balances, and ensure seed backups are safe at home, not in your bag.
- Itinerary risk map: Note countries with SIM-swap prevalence or aggressive border checks; plan to use hotspot and avoid public Wi-Fi.
Post-travel (first session back home/hub)
- Rotate passwords for broker/admin email; review authorized devices and active sessions; revoke anything unknown.
- Audit alerts: Scan login and withdrawal alerts for anomalies during the trip.
- Malware sweep: Update AV/EDR, run a scan; review browser extensions in the finance profile.
- Wallet check: Verify on-chain balances with a watch-only wallet; if any doubt, sweep funds to fresh addresses.
- Carrier review: Confirm no SIM changes or porting occurred; keep number lock in place.
- Paperwork: File travel receipts and any broker statements; update your IPS with lessons learned.
Incident response playbook
When—not if—something goes wrong, time and sequence matter. Keep this short list accessible offline.
Phone lost or stolen
- Use Find My to erase and disable Apple/Google Pay.
- Contact carrier to suspend the SIM and enforce port lock.
- From a safe device, rotate admin email password and broker/exchange passwords; invalidate sessions.
- Switch to backup 2FA (hardware key #2 or TOTP backup codes).
- Notify broker/exchange via secure message to monitor/flag account for unusual activity.
Suspected SIM-swap
- Put the line in port-out freeze immediately via carrier support; set/confirm account PIN.
- Move critical logins to app/keys-based 2FA; remove phone number as a recovery factor.
- Change admin email password and re-issue recovery codes.
- Ask broker to enforce whitelist only withdrawals and add manual review for a cooling period.
Broker account compromise
- Freeze the account (many brokers allow a security hold); call support using numbers from your offline sheet.
- Rotate passwords; revoke API keys and sessions; change email if needed.
- Verify beneficiaries/whitelists; restore correct list; extend cool-off windows.
- File a ticket to investigate IP logs and order history; preserve timestamps for your records and insurer.
- After containment, reset devices used for access (fresh OS or new user profile).
Seed phrase exposed
- Assume total compromise of that wallet path.
- On a clean device, generate a new wallet; move funds via full sweep to new addresses.
- If using a passphrase/hidden wallet, assume it’s leaked too unless you’re sure only the decoy was exposed.
- Rotate any exchange withdrawal addresses to the new cold wallet.
Public Wi-Fi “oops” (logged into broker on airport Wi-Fi)
- From a known-good network, log out, change password, and kill sessions.
- If session tokens could be stolen (no hardware-key challenge), contact broker to invalidate all devices.
- Treat the device as suspect; scan it and restrict finance access to the clean profile until you’re confident.
Resources
Security for digital nomads is not about paranoia—it’s about defaults that make mistakes survivable. If you do nothing else, do this:
- Make phishing toothless with a hardware key (plus a backup) for your broker, exchange, and admin email.
- Assume loss: encrypt devices, shorten auto-locks, remove SMS from the equation, and carry printed backup codes.
- Keep ops clean: a dedicated finance browser profile, hotspot over public Wi-Fi, and withdrawal whitelists with cool-offs.
- Rehearse recovery: know your support script, test wallet restores, and keep spare factors off your person.
Do that, and you’ll protect what matters while still living the way you want—light, mobile, and in control.
Related guides:
- Where to Buy Gold in Europe – Detailed guide about the process.
- Crypto Reporting Basics – Quickstart guide for Crypto reporting.
- Ledger vs Trezor – Hardware Wallets · Criptomonedas para novatos – Basic Custody concepts
