Travel changes the conditions under which you read and send mail. You join networks you do not control, sit at borrowed computers, carry devices through airports and hotels, and receive messages about bookings, deliveries and payments that look urgent. None of this is unusual, and most of the risks are manageable with a few habits set up before you leave. This article covers the practical steps for keeping your inbox in order on the road.
Before you leave
- Confirm your second factor works on your phone and on a backup device, and that your recovery codes are stored somewhere you can reach offline.
- Check that each device has a screen lock and full-disk encryption enabled.
- Review active sessions under Account > Security and sign out of anything you no longer use.
- Remove mail you do not need to carry. Old attachments are the most sensitive part of most mailboxes, and they are easy to leave behind.
- Make sure you have a current backup or mirror, so a lost laptop does not take your mail with it.
Public and hotel networks
Mail clients connecting to ITProMail use TLS on port 993 for IMAP and port 465 or 587 for SMTP, so the content of your session is protected from passive observers on the same network. What TLS does not protect is the fact that you are connecting, the server names you reach, and anything you do outside the mail connection. Captive portals and unexpected certificate warnings are worth taking seriously. If a client asks you to accept a new certificate for the mail server, stop and check; the expected certificate should not change while you travel.
A phone hotspot is usually a safer choice than an unknown Wi-Fi network. A VPN you trust can reduce what the local network sees, but it moves that trust to the VPN provider, so choose it with the same care you would choose a mail provider.
Shared and borrowed computers
Avoid using a computer you do not control to read or send private mail. If you have no alternative, reduce the damage:
- Use a private or incognito browser window, so no history or cookies are kept.
- Do not save passwords in the browser, and do not accept prompts to remember them.
- Do not download attachments to the shared machine. Read the message in place if you can.
- Log out of webmail when you finish, and check that the session is gone from Account > Security.
- Close the window fully rather than just the tab. Be aware that a webmail session lasts 30 days unless it is revoked, so a forgotten login can stay valid for a long time.
If you used a borrowed computer, revoke any session it might have created as soon as you can, and change the password if you typed it there.
Lost or stolen devices
Preparation matters more than response. Use a screen lock with a short timeout, enable device location and remote wipe where your platform supports them, and keep a note of how to revoke access from another device. For mail specifically, the most useful action is revoking the app password for the lost client and signing out the sessions that could still be open. Then change your login password if the device had it stored, and review recent activity.
Local mail caches are the other concern. Thunderbird, Apple Mail and phone clients keep copies of recent mail. Decide before travelling how much you want on the device. For a sensitive trip, consider a client configured to fetch headers only, or a device that holds no archive at all.
Phishing aimed at travellers
Travellers receive a steady stream of messages that are designed to feel urgent: a hotel asking for a card to hold a room, an airline announcing a schedule change with a link, a courier needing a fee paid, a rental company asking you to confirm a booking. Attackers know that people on the move are less likely to check details. The defences are the same as usual, applied with more discipline:
- Go to the airline, hotel or courier through their app or a bookmarked site, not through a link in the message.
- Be suspicious of attachments named as tickets, invoices or boarding passes. See safe attachment handling for the file types to distrust.
- Treat payment requests that arrive by email as suspect until you confirm them by phone on a number you already have.
- Check the sender domain, not just the display name.
The longer guide to these patterns is in spotting modern phishing.
Border crossings and device searches
Some travellers worry about devices being examined at borders. The rules differ by country and change over time, and this is not legal advice. The practical measures that help regardless of jurisdiction are the same as for lost devices: full-disk encryption, strong device passwords, and carrying only the mail and files you need. Mail that is read from the server through a browser leaves less on the device than a full local archive. If the question matters for your trip, check current guidance for your destination and consider a travel-specific device.