Why banks do this

Fraud models score every login and transaction, and geography is a heavy input: a login from an IP address in a country you have never banked from looks exactly like a stolen credential. Some banks step up verification; some, particularly smaller and regional ones, block foreign IP ranges outright. Behaviour varies wildly between banks and changes without notice, so treat any specific bank’s reputation, ours included, as a snapshot of reader and community reporting rather than policy: banks do not publish these rules, on purpose.

The reported pattern among big US banks, useful as expectation-setting rather than gospel: Bank of America is widely described as the hardest for international access and actively blocks most VPN ranges, Chase and Wells Fargo block aggressively too, Citi’s app works from most countries (with SMS codes arriving slowly abroad, so switch to its authenticator first), and Capital One is repeatedly reported as the least aggressive about VPN connections. European and UK fintech-generation banks are broadly more travel-tolerant than the legacy names.

Fix one: look like you are at home

A VPN with a server in your home country gives the fraud model the input it wants: a familiar IP address in a familiar place. This resolves the majority of hard geo-blocks, and it is among the most practical daily reasons travellers run a VPN at all, ahead of the security theatre. Two practicalities: pick a provider with solid server coverage in your home country specifically, and connect to the same city consistently, because a login from your home country is good and a login that teleports between cities daily is not. Our travel VPN ranking weighs home-country coverage for exactly this reason.

One caution worth stating: banks’ terms rarely prohibit VPN use, but their fraud models can also flag known data-centre IP ranges. If a login fails through the VPN, try once without it on mobile data before assuming lockout; between the two paths, one nearly always works.

Fix two: the SMS code problem, solved with dual SIM

The sneakier failure: the login works, then the bank sends a verification code to your home number, which sits in a drawer at home inside a physical SIM. This one has a clean solution. Install your travel data as an eSIM and keep your home SIM active in the phone alongside it, with data roaming off for the home line. Texts arrive on the home number free or nearly free in most destinations; your data flows through the travel eSIM; both live in one phone. This dual-SIM arrangement is the standard setup we describe in the iPhone install guide, and the receive-codes-while-abroad case is the single best argument for it.

Longer term, move what your bank allows to app-based confirmation instead of SMS: app confirmations ride data, work anywhere, and are more secure anyway.

Fix three: preventing the card freeze

Login access is half the problem; the other half is the card itself getting frozen after its first foreign transaction. The prevention list is short: set a travel notice in the app where your bank still offers one, make the first foreign transaction a small one rather than a hotel bill, and carry a second card from a different bank on a different network, kept in different luggage. Travel-first cards from the fintech generation, built for exactly this, are their own topic over in our travel money hub.

The before-you-fly banking checklist

Do those five and the bank problem mostly stops existing. On the road, the remaining rule is situational: do banking on mobile data or through the VPN, never on raw hotel or airport wifi, for the reasons the hotel wifi threat model lays out.

📷 SCREENSHOT NEEDEDA banking app’s travel-notice setting screen, the five-minute prevention this section describes.

Already locked out abroad? The recovery ladder

If you are reading this from a hotel with a frozen login, work the ladder in order. First, the cheap wins: try the login on plain mobile data if you were on wifi, or through the VPN’s home-country server if you were direct; between those paths one usually clears the geo-flag. Second, the app rather than the website, or the reverse: banks’ fraud rules often differ between the two front doors, and the other one may still be open. The sequence with the best reported hit rate against VPN-hostile banks: clear the browser cache, connect to a home-country server, log in via the browser first rather than the app, complete the 2FA there, and only then try the app.

Third, self-service unlock: many banks’ “verify it’s you” flows work from abroad if you can receive the code, which is where the home-SIM-active arrangement pays for itself retroactively. No SMS access is the hard wall; some banks will move verification to email or in-app approval if you can reach any logged-in session on another device, which is a strong argument for not logging out of the tablet that stayed in the hotel safe.

Fourth, the phone call, with the fraud line number you saved and the patience you did not: call centres can verify identity by other means and lift flags on the spot. If the card itself is frozen rather than the login, this is usually the only rung that works. And afterwards, do the five-item checklist above for the next trip, because every rung of this ladder is more pleasant at home than it was just now.

Check NordVPN