Payment content is protected by HTTPS, while a VPN changes the visible network address and the route of the connection. It does not protect against phishing, fake shops or password theft. Your bank may request verification or restrict sign-in from a VPN address. Hotels and flights are sometimes cheaper on a different regional version of a website, but switching country does not guarantee savings.
Connection protection
A VPN (virtual private network) encrypts the connection from your device to the operator's server, including when paying over a public network. HTTPS, the protocol for a secure connection to a website, separately encrypts the content of the exchange, such as your password and card number.
Check the website address regardless of your connection. A fraudulent shop can also use HTTPS: encryption does not confirm the seller's trustworthiness.
| Party | Without a VPN | With a VPN |
|---|---|---|
| Internet provider or local network | Sees information about connections, but not HTTPS content | Sees a connection to the VPN server; the tunnel's content is encrypted |
| VPN operator | Not involved in the connection | Gains the ability to observe network destinations; HTTPS continues to protect the content |
| Bank or payment service | Sees the ordinary external IP of the connection | Sees the VPN's exit IP; account details and transactions are still recorded |
| Shop | Receives the information you provide when ordering | Still receives the order information, including the delivery address you specify |
An IP address is the network address of a connection, from which its approximate location is determined. Replacing it does not erase your purchase history. As EFF explains in its guide to VPNs, part of the trust shifts from your internet provider to the VPN operator; payment anonymity does not follow from this.
Incognito mode does not make banking any safer: it does not replace HTTPS and does not verify the recipient of the money.
Unusual sign-in checks
Risk systems compare a new sign-in with the account owner's usual behaviour. An unfamiliar IP or a sudden change of country can trigger a verification request, a fraud warning or a temporary account block.
This logic is described in the Microsoft Entra documentation: the system flags anonymous VPN addresses, geographically unusual sign-ins and unfamiliar device properties. This is an example of a corporate system, not bank documentation: you should not assume that any particular bank applies the same rules.
Only confirm an action you started yourself. If you receive an unexpected notification without any sign-in attempt or purchase on your part, check the transactions in your banking app.
Regain access to your bank
Stay in one location while restoring access to your bank. Do not switch between countries during a session: this makes the sign-in look even more unusual. A rejection or a missing code does not on its own prove that the VPN is the cause.
| Situation | Next step |
|---|---|
| The rejection appeared when connecting via another country | End the attempt and choose a server in your bank's country |
| Sign-in also fails from your usual location | Temporarily turn off the VPN and sign in again over a trusted connection, such as a mobile network |
| The app works directly but regularly rejects VPN connections | Check whether you can exclude the banking app from the tunnel |
| Without a VPN the problem persists or the account is blocked | Contact the bank using the number in the app, on your card or on the official website |
Split tunnelling is a setting in which selected apps use a direct connection while the rest run through the VPN. The Android documentation states that an excluded app accesses the network as if no VPN were running. Whether you can choose such an exclusion depends on the client and the platform.
If you want to keep the rest of your traffic inside the tunnel, CitadelVPN is suitable for this task: split tunnelling is included in all plans. Check that exclusions are supported in your client, or contact the service's support team for help with setup. A direct route does not guarantee that sign-in will be allowed: other reasons for verification remain.
For example, a bank rejects sign-in only when the VPN is on. You add the app to the exclusions and sign-in works: banking traffic now goes directly, while the rest stays in the tunnel.
Regain access to your bank
an excluded app accesses the network as if no VPN were running
A direct route does not guarantee that sign-in will be allowed: other reasons for verification remain.
Check the shop before paying
Before paying, the British National Cyber Security Centre recommends checking the seller, using a credit card where available and avoiding direct bank transfers for online purchases. Payment protection terms for PayPal and other intermediary services should be checked separately.
- Verify the shop's domain, especially after following a link from an email or advert
- Fill in only the required order fields
- Do not create an account if guest checkout is available
- Do not store payment details in your browser
- Enable two-step verification for important accounts
- Check the amount and recipient before confirming
Two-step verification is an additional identity check after your password. It protects access to your account but does not vet the seller.
PayPal and cryptocurrency
PayPal and a crypto exchange see the VPN server's address when you connect through a VPN, but your name, delivery address and account documents do not disappear because of this; bitcoin transactions remain public. For more on the limits of such protection, see the breakdown of what a VPN hides when paying via PayPal and buying cryptocurrency.
Hotel and flight prices
Prices may differ depending on the country of your IP address and the version of the website; price discrimination and personalisation may also draw on your account details and cookies, so changing country or clearing cookies does not guarantee a discount. For hotels, flights and Airbnb, any saving should be judged on the final price with identical terms: a separate guide explains how to check whether hotels and flights are cheaper from a different location.
Frequently asked questions
Why did a 3-D Secure prompt appear when paying?
3-D Secure is a mechanism by which the card-issuing bank carries out an additional check of a card transaction. According to EMVCo's description, the bank receives information about the transaction, the payment method and the device, and may request verification when the risk is elevated. Such a prompt does not in itself mean a compromise; you cannot establish from a single request that the VPN caused it.
Why did a 3-D Secure prompt appear when paying?
Does a VPN protect against a fake shop?
No. The website you entered your details on receives the order information, even over an encrypted connection. If your details have been given to a suspicious shop, tell your bank.
What should I do if a purchase turns out to be a fraud?
Contact your bank immediately on its official number and report the transaction. In England, Wales and Northern Ireland, also report it to Report Fraud; in Scotland, report it to Police Scotland. Keep the order confirmation, correspondence and payment details.
Decide whether to keep the VPN on
Let the sign-in result decide: if your bank accepts the VPN, there is no need to switch it off in order to pay. If it is rejected, try your usual country or a direct connection. HTTPS protects the payment content; check the shop and the amount whether or not you use a VPN. Confirm any booking savings on the final price before paying.