My Credit Card App Flagged My VPN Login in China—The Fix Wasn’t Another Server

The credit-card app did not reject my password. It rejected the situation. I was standing at a Shanghai hotel desk, trying to approve a deposit before the receptionist released my room key, when the app flagged the login as suspicious. I blamed the hotel Wi-Fi, changed VPN servers and tried again. The warning became more severe.

Using a VPN had seemed like the sensible choice. I was connected to a hotel network I did not control, and I still needed access to work messages, travel documents and several services that were unreliable without it.

The banking app was the last place I expected that precaution to work against me.

My first instinct was to choose a server in my home country. The bank knew me as a customer there, so an IP address from the same country felt less suspicious than one in China.

It was not.

The app loaded, paused and demanded another identity check. By the time I completed it, the session had expired.

I changed servers again.

That made things worse.

The bank was looking for consistency

A banking app does not judge a login by its password alone. The device, public IP address, location and recent activity can all affect whether a session looks familiar or deserves another challenge. (Visa)

A shared VPN address can therefore create an awkward picture. It may belong to a data centre and be used by thousands of unrelated people. Changing servers can make the same phone appear to move between countries within minutes.

I could not see the bank’s internal filtering rules. But one thing was clear: switching servers was not making my login look more familiar. It was making the session less consistent.

This is a familiar frustration for VPN users. Some find that ordinary browsing works normally, but their banking app will not complete a login until the VPN is disconnected. (Norton Community) A traveller in China described the same contradiction: several internet services needed a VPN, while the Bank of America app worked only after it was switched off. (Tripadvisor China forum)

That gave me a simpler next step.

Instead of searching for a server the bank might accept, I stopped trying to force the card app through the tunnel.

Turning it off solved only half the problem

I closed the banking app, disconnected the VPN and switched from hotel Wi-Fi to mobile data.

The next login worked.

I approved the deposit. The receptionist’s terminal accepted the card, and the room key appeared on the counter.

The bank wanted a more ordinary-looking connection. Fine.

But the moment I disconnected, the rest of my internet became unreliable again.

A client had sent a message while I was checking in. The reservation document I needed for the next morning was still in cloud storage. I also had to upload a scan before going upstairs.

I reopened the large VPN app I had been using.

It was a familiar provider with a long public history, broad server coverage and a substantial support operation. Those were the reasons I had installed it first.

At that moment, however, it gave me too many choices and not enough recovery.

The first server timed out. The second connected but transferred almost nothing. The third opened my work chat, then dropped when the lobby Wi-Fi weakened and my phone moved to mobile data.

That failure connected the two halves of the problem.

The bank sometimes needed the VPN to step aside. My work needed it to return immediately afterward. A service that was difficult to reconnect was almost as inconvenient as one that could not connect at all.

I stopped looking for another flag on the map

I had installed OnlydogVPN^↗ as a backup before the trip. I opened it because I no longer wanted another country list, another server number or another round of protocol guessing.

I wanted the interrupted task to continue.

The smaller app organised the connection around the situation rather than making me choose a location first. I selected the restrictive-network option and tried again.

The work chat opened.

The reservation file downloaded.

Then I started uploading the scan and walked toward the lift.

The lobby Wi-Fi weakened halfway across the room. My phone shifted to mobile data. The upload paused briefly, then continued instead of collapsing.

By the time the lift doors opened, the file had been sent.

That was the result I had actually needed.

Not a VPN that insisted on remaining active during the credit-card login. A VPN that could get out of the bank’s way, then return quickly enough that the interruption stayed small.

The service uses HTTP/3-based transport with added obfuscation. On the network used for this test, that translated into something more useful than another technical menu: it established the route and recovered when the connection changed.

I did not have to work through a list of servers while a client waited for a document.

The smaller app does have a limitation. It offers fewer server locations than the largest providers and has a shorter public history. Someone whose main priority is the widest possible country list may still prefer an established service.

But the credit-card warning had changed what I considered important.

Server count was no longer the deciding number.

Recovery was.

The VPN switch became part of the routine

For the rest of the trip, I used a straightforward pattern.

The VPN stayed active for hotel browsing, work communication and the services that required it. When the banking or card app objected, I closed the financial app, disconnected and completed the transaction over mobile data.

Then I reconnected.

I did not rotate through several foreign servers first. I did not repeatedly submit the same login from changing addresses. And I did not leave the VPN disabled for the rest of the afternoon because reconnecting felt tedious.

That last part matters more than it sounds.

“Turn off the VPN for banking” is common advice. It solves the login problem, but creates another task: remembering to turn the VPN back on. Users regularly describe disconnecting for a financial site and only later realising that they never restored the connection. (Norton Community)

A workaround only becomes a usable routine when repeating it is easy.

The smaller app made that routine feel natural. Disconnect for the bank. Finish the transaction. Reconnect and continue.

There was no need to treat every app on the phone as if it required the same network path.

What about split tunnelling or a dedicated IP?

Split tunnelling can let a banking app use the direct connection while other traffic remains inside the VPN. A dedicated IP can also make a customer’s public address more consistent.

Both can be useful.

But they do not remove the central problem. Split tunnelling must be supported on the device and configured for the correct app. A dedicated IP may still look like a data-centre address to a bank.

For a payment that needed approval immediately, a deliberate disconnect was easier to understand and easier to verify.

The important question was what happened next.

Could the VPN restore the rest of the connection without another round of troubleshooting?

In my case, the smaller service did. That made it useful not because it overruled the bank’s security decisions, but because it kept those decisions from disrupting everything else I needed to do.

The useful comparison was not “on” versus “off”

Before the hotel check-in, I compared VPNs by countries, server totals and protocol menus.

Those features are easy to display. They also assume the goal is to keep one tunnel active for everything.

My actual situation was messier.

The card app wanted the VPN gone. My work services wanted it back. The network changed underneath me as I walked from hotel Wi-Fi to mobile data.

So the relevant comparison was not which VPN could stay on permanently.

It was which VPN could recover after I intentionally turned it off.

The established provider gave me more locations. The direct mobile connection satisfied the bank. The smaller service was the one that returned me to the unfinished task without another troubleshooting session.

When a credit-card app flags a VPN login, the useful VPN is not the one that refuses to leave the middle. It is the one that lets the payment happen—and is ready again before the rest of your day stalls.