When Not to Use a VPN: 5 Scenarios

VPNs are often treated as a non-negotiable part of the nomad toolkit: install it, switch it on, forget about it. Much of the time that is a reasonable default. A virtual private network encrypts the traffic between your device and a remote server, which shields it from whoever runs the café Wi-Fi and hides your real IP address from the sites you visit.

But being always on is not the same as always being right. The features that make a VPN useful can also cause problems. It gives you a different apparent location, a shared IP address and an extra hop in the network path. Those same features can lock you out of your bank or put you in breach of your employment contract. They can create legal exposure abroad, or turn a clear video call into a stuttering mess.

This guide covers five specific scenarios where you should pause your VPN, change its settings or skip it entirely. It ends with a practical framework for deciding in the moment. The aim is not to argue against VPNs. It is to help you use one on purpose rather than by habit.

What a VPN Actually Does (and What It Doesn't)

A VPN creates an encrypted tunnel between your device and a server run by the VPN provider. Your traffic leaves that server, known as the exit server, and travels on to its destination from there. Two things change as a result. First, the local network (a café, hotel or mobile carrier) can see that you are connected to a VPN, but not what you are doing. Second, the websites you visit see the exit server's IP address instead of yours. IP addresses are mapped to rough geographic locations, so this also changes where you appear to be.

What a VPN does not do matters just as much. Most web traffic already uses HTTPS, which encrypts your session between your browser and the website on any network. A VPN does not stop phishing, malware, or an account takeover through a reused password. It also does not make you anonymous to services you log into: your bank knows who you are the moment you enter your credentials. And a VPN moves trust rather than removing it. Instead of trusting the café network, you are trusting the VPN provider.

A useful tool here is a threat model, which is a short, honest answer to the question "what am I protecting, and from whom?" If the threat is an untrusted local network, a VPN helps. If you are dealing with a fraud system or a compliance team that needs to know your real location, the VPN may be working against you. Each of the five scenarios below is a case where the threat model flips.

Scenario 1: Logging Into Banks and Payment Apps

Banks, brokerages and payment providers run fraud-detection systems that score every login. They look at signals such as your device fingerprint, your usual login times and your IP address. Most commercial VPN servers sit in data centres, and a login from a known data-centre IP range is a classic risk signal. So is a login from a country you have never visited. The result can be anything from an extra verification step to a frozen card or a locked account that takes a phone call to resolve. Some providers block VPN IP ranges entirely. Some regulated services are also required by their licence to restrict access from certain countries, and getting around those restrictions on purpose can breach their terms of service.

For nomads, geography makes this worse. Say you are physically in Portugal and your card has just been used at a Lisbon café. If your banking app then logs in from a New York VPN server ten minutes later, you have created an "impossible travel" pattern, which fraud systems are built to catch. There are safer options. Use your bank's official app over mobile data, since the app already encrypts its own traffic. You can also use split tunnelling (a feature that sends selected apps outside the VPN) to exclude financial apps. If you must use a VPN on public Wi-Fi, choose a server in the country you are actually in.

Warning: Being locked out of your main bank account abroad is one of the most disruptive things that can happen on the road. It is especially painful when the bank sends verification codes by SMS to a home SIM you are no longer carrying. Always keep a backup payment method with a different provider, and never experiment with VPN locations on financial apps.

Scenario 2: Working on Employer Systems or Hiding Your Location From Work

Many employers require you to connect through a corporate VPN or a secure access tool to reach internal systems. Running a personal VPN at the same time, sometimes called a "double VPN" setup, often breaks the connection or triggers security alerts. It may also break the company's acceptable-use policy outright. Security teams watch for unusual connection patterns, and a session coming from a consumer VPN provider can look a lot like a hacked account.

The bigger risk is using a VPN to look as if you are working from somewhere you are not. Where you physically work has legal consequences. It affects employment law, payroll tax and a corporate tax concept called "permanent establishment". Permanent establishment is the idea that an employee's long stay in a country can create a taxable presence there for the employer. Suppose your employer believes you are at home while you actually spend five months abroad. The company may then face obligations it never agreed to, and you may be in breach of your contract. Getting found out is more common than people expect, because HR systems, travel bookings, expense claims and device data all reveal location.

The lasting solution is to get your employer's approval in writing and use a proper legal route for working abroad. Several countries now offer visas designed for remote workers, such as the one covered in our guide on how to get a 3-year digital nomad visa in Spain. These visas require you to be open about where you are and who you work for. A VPN cannot make an unapproved arrangement legitimate. It only delays the moment someone notices.

Scenario 3: Travelling in Countries That Restrict VPN Use

VPN rules vary widely from country to country. A few countries ban or heavily restrict VPNs. Others allow only government-approved providers. Some don't outlaw the VPN itself but punish using one to commit or hide another offence. For example, China allows only state-approved VPN services, Russia has blocked many commercial VPN providers, and the UAE penalises using a VPN to commit crimes or avoid their detection. How these rules are enforced against foreign visitors varies a lot and is often unpredictable, and that unpredictability is exactly the problem.

Even where tourists are rarely targeted, the potential downside is far bigger than the benefit. A fine, a phone search at the border or trouble with a residence permit costs much more than the convenience of streaming your home country's TV catalogue. Using a VPN to reach content that is illegal locally can move you from a grey area into clear legal trouble. Depending on the country, that might mean certain internet calling services, gambling sites or political material.

Note: Laws and enforcement change, and this section is general information, not legal advice. Before arriving somewhere with known restrictions, check your government's current travel advice and recent news reports. Think about whether your work can wait, whether it can be done over a local connection through approved channels, or whether it should go through an employer-approved tool with its own legal basis.

Scenario 4: Connecting to Captive Portals and Local Services

Captive portal connection sequence

Ordered steps to safely join captive-portal Wi-Fi and re-enable your VPN.

1. Disable VPN and kill switch

   Turn off both to allow the portal redirect to reach you.First

2. Join the Wi-Fi network

   Select the network from your available list.

3. Complete the portal login

   Enter credentials or accept terms as required.

4. Verify internet access

   Check that you have connectivity before proceeding.

5. Re-enable your VPN

   Turn it back on for the remainder of your session.Last

IllustrativeA summary of the steps described above, not a measured schedule.

A captive portal is the login or terms page that appears when you join Wi-Fi at a hotel, airport, train or coworking space. It works by catching your first web request and sending you to the login page instead. If your VPN tries to connect first, that redirect never reaches you. The same happens if your kill switch is active. A kill switch is a VPN feature that blocks all internet traffic whenever the VPN is not connected. The symptom is familiar: "Connected, no internet", with no login page in sight.

The fix is to do things in the right order. Turn off the VPN and kill switch, join the network and complete the portal page. If the page doesn't appear, try visiting a plain http:// address, which usually forces the redirect. Check that you have internet access, then turn the VPN back on. Many shared living and working spaces, including those in our roundup of affordable co-living spaces for digital nomads, use portals or device registration, so you will do this often. During the short window without the VPN, avoid logging into anything sensitive.

The same logic applies to local services. Ride-hailing apps, food delivery platforms, local banks and government websites often limit access by location or block foreign and data-centre IP addresses. That includes visa portals, local tax filing and immigration appointment systems, which may reject VPN connections or flag them for review. Draw attention there is the last thing you want during an immigration process. For these services, pause the VPN or add the apps to your split-tunnelling exclusions.

Scenario 5: When Speed and Latency Matter More Than Privacy

Every VPN slows your connection to some degree. Your device has to encrypt everything, and your data takes an extra trip through the VPN server. The key measure is latency, which is the time data takes to reach its destination and come back, measured in milliseconds. If you are in Southeast Asia and connected to a server in Europe or North America, every request travels thousands of extra kilometres. For ordinary browsing you will barely notice. For video calls, screen sharing, voice calls and live collaboration, it shows up as talking over each other, echo and frozen video.

Weak connections make it worse. On a rural guesthouse connection or a crowded mobile network, the VPN can noticeably reduce your usable speed. It may also keep dropping and reconnecting, cutting off large uploads halfway through. Meanwhile, the major video-conferencing platforms already encrypt your calls in transit, so the VPN adds little privacy for that traffic and makes the experience clearly worse.

There are better options. Hotspotting from a reliable local SIM or eSIM avoids the untrusted Wi-Fi problem entirely, and our Nomad SIM card review covers whether a travel eSIM is worth it. If you prefer to keep the VPN running, exclude your calling apps through split tunnelling and pick a server close to where you are. If your provider offers it, use a lightweight protocol such as WireGuard, which tends to handle unstable networks better than older protocols.

A Practical Framework: Keep It On, Split, or Pause

Choose your VPN strategy

Decision path from four key questions to the right VPN strategy for your situation.

Q1

Is VPN use legal and low-risk where you are?

No

No

Pause it or use approved tools only

Check local restrictions before arrival.

Yes

Q2

Does this service depend on knowing your real location?

No

No

Exclude it from the VPN or pause it

Banks, employers and government portals need your true location.

Yes

Q3

Is this task sensitive to delay, like a video call?

No

No

Split tunnel or use mobile data

VPN latency harms real-time communication.

Yes

Keep the VPN on for this task

The network is untrusted and no other factors apply.

IllustrativeA rule of thumb from the advice above. No figures shown.

Using a VPN well is rarely a simple on-or-off choice. In practice you have three options. You can keep it on for everything. You can split tunnel, sending most traffic through the VPN while selected apps or websites use your normal connection. Or you can pause it for a specific task and turn it back on afterwards. Most good VPN apps support all three. Setting up split tunnelling once, for banking, local services and calling apps, removes most of the friction described in this guide.

To choose between them, ask four questions in order. Is VPN use legal and low-risk where I am? If not, pause it or use only approved tools. Does this service depend on knowing my real location, as banks, employers and government portals do? If so, exclude it or pause the VPN. Is this task sensitive to delay, like a video call? If so, split tunnel or use mobile data. Finally, is the network untrusted? If yes, and none of the earlier answers apply, keep the VPN on.

A few mistakes come up again and again. People leave the kill switch on at captive portals, then wonder why the Wi-Fi "doesn't work". They connect to a home-country server for banking while abroad, creating the impossible travel pattern that fraud systems look for. They assume a VPN makes them anonymous to services they are logged into. And they rely on free VPNs, whose business model may depend on logging and selling the very data you are trying to protect. Avoiding these four mistakes matters more than which provider you choose.

A VPN is a good tool for one specific job: protecting your traffic on networks you don't control. It is not a cure-all. In the five scenarios above (banking, employer systems, restrictive countries, captive portals and latency-sensitive work), the features that make a VPN useful become risks instead.

The habit to build is deliberate use, not constant use. Set up split tunnelling once and keep a reliable mobile data plan as a fallback. Before switching the VPN on, run through the four questions: is it legal here, does this service need my real location, does speed matter, and is this network trustworthy? Answer those honestly and your VPN will protect you without getting in your way.