Should I Turn Off My VPN for Banking Apps? I Didn’t—and Locked the Card Before the Next Charge

The first notification showed a $94 purchase at a store I had never visited.

The second charge arrived before I finished reading the merchant’s name.

I was standing beside a departure board at Paris Charles de Gaulle, where my mobile signal had faded to one bar. The airport Wi-Fi worked well enough for messages, so my phone had joined it automatically through the VPN I used while travelling.

I tapped the bank notification.

The app completed Face ID, then displayed a warning instead of my card controls:

VPN connection detected. Turn off your VPN and try again.

I blamed the airport network.

I disconnected from Wi-Fi, waited for mobile data and reopened the app. The login screen appeared, but the weak signal stalled before my accounts loaded.

Then the phone returned to airport Wi-Fi.

The VPN warning came back.

A third notification appeared. This one was only a few dollars—the sort of test charge that can arrive before something larger.

I needed to freeze the card.

The bank’s website might eventually have let me sign in, but searching through browser menus while suspicious charges continued was not the task in front of me. The app had placed Lock Card directly inside the alert.

All I had to do was reach it.

Turning off the VPN worked—and created another problem

I disabled the VPN and reopened the banking app.

Face ID completed.

The card alert appeared immediately.

That proved the account, phone and app were working. The VPN route was the part the bank disliked.

I was one tap away from freezing the card, and for a moment the decision seemed obvious: lock it first, then turn the VPN back on.

But the phone was still connected to a crowded airport network. Email, cloud files, messaging apps and background services were all using the same connection.

Banks themselves advise travellers to be careful on public Wi-Fi. Chase recommends a secure private connection for online banking and notes that a VPN can add protection when a public network must be used. Bank of America offers similar travel advice. (Chase)

So the useful question was not whether the banking app worked without a VPN.

It did.

The question was whether protecting the phone should prevent me from reaching the bank’s own security controls.

I turned the VPN back on before pressing Lock Card.

The warning returned.

The bank recognised me but rejected the route

Banks have become more sensitive to unusual connections for good reason. Consumers reported losing about $16 billion to fraud in 2025, the highest annual total recorded by the Federal Trade Commission. (Ftc)

The app was not relying on my password alone. It could compare the device, Face ID result, recent account activity and network connection before allowing a sensitive action.

Several signals already pointed to me. The alerts had reached my usual phone. Face ID passed. I had opened the app from a device the bank had seen before.

The unfamiliar part was the VPN exit route.

A shared address used by many unrelated customers can look very different from a normal home or mobile connection. That helped explain why the app accepted my identity and still stopped the session.

I did not need the bank to weaken its fraud checks.

I needed the VPN to stop becoming the suspicious part of an otherwise legitimate request.

That changed what I tested next. Speed and distance mattered less than whether the bank would let the session reach the lock button.

More servers gave me more versions of the same failure

My regular provider was the obvious place to continue.

It had a long public history, a mature application and servers throughout Europe. I chose its recommended French connection and reopened the bank.

The warning appeared again.

I moved to Belgium.

This time the app accepted Face ID and displayed my account for several seconds. When I opened the card controls, the session ended.

A German server reached the fraud alert but froze before the lock button responded.

The provider’s fastest server sent me back to the original warning.

Every connection looked healthy inside the VPN app. The shield was green. Latency was low. Ordinary websites loaded quickly.

The card remained active.

Other banking customers describe the same pattern succinctly: the app works as soon as the VPN is disabled and blocks again when it returns. (Reddit)

That confirmed what the repeated attempts were already showing. The provider was encrypting my traffic, but its routes were preventing the banking session from finishing.

More server choices gave me more places to fail.

They did not stop the next charge.

Split tunnelling protected everything except the bank

The established provider offered a bypass feature.

I could exclude the banking app from the VPN while leaving the rest of the phone protected. That was better than switching off the entire tunnel, and it made the warning disappear.

The bank opened.

The card controls loaded.

My thumb hovered over Lock Card.

Then I looked at the arrangement I had created.

Email, social apps and background traffic remained inside the VPN. The application containing my balances, card number, transaction history and security controls was the deliberate exception.

The banking app still used its own encrypted connection, but the workaround felt backwards. I had installed a VPN so I would not have to decide which sensitive activity deserved protection on an unfamiliar network.

The bypass did prove one useful point: the bank was not blocking my identity, device or location. It was rejecting the original tunnel.

I removed the exception.

The warning returned.

By then, the third charge had moved from a notification into the transaction list. My gate was a ten-minute walk away.

I no longer needed a workaround that removed the bank from the VPN.

I needed a route the bank would accept.

The card controls opened inside the new tunnel

I closed the first provider and opened OnlydogVPN.

The smaller app did not begin with a map or ask me to choose among nearby countries. I selected the situation for a restrictive network and connected.

Then I force-closed the banking app so it would start with a fresh session.

I reopened it.

Face ID completed.

No VPN warning appeared.

The account screen stayed open.

I tapped the fraud alert, reviewed the three charges and selected I don’t recognise these transactions.

The card-control page appeared.

I pressed Lock Card.

The switch changed from green to grey.

A confirmation followed:

Your card is locked. New transactions will be declined.

The replacement-card process opened next. The bank kept every normal safeguard in place: another biometric check, confirmation of my mailing address and a final review before submission.

I completed those too.

The original card was frozen, the unfamiliar charges were reported and a replacement was being prepared.

The phone had remained inside the VPN throughout the entire process.

Only after the card was safe did the technology matter. The service uses an HTTP/3-based transport with additional traffic obfuscation, allowing the connection to blend more naturally with ordinary modern web traffic.

I could not inspect the bank’s internal risk rules or identify the exact signal behind each earlier rejection. The result was still decisive: the major provider repeatedly exposed a route the app refused, while the smaller one carried the full security process from Face ID to card replacement.

The airport network changed before the problem was finished

Locking the card stopped new purchases, but I still needed to check whether the bank required more information about the disputed transactions.

I started walking toward the gate with the app open.

Airport Wi-Fi weakened near passport control. The phone moved briefly to mobile data, then joined another airport access point farther down the terminal.

The transaction page paused.

I expected the app to end the session and demand another login.

Instead, it refreshed.

The disputed charges remained marked for review. The card still showed as locked.

The VPN had stayed connected while the network underneath it changed. Its HTTP/3-based route recovered without forcing the banking session to restart. (IETF)

The practical result was simple:

The airport Wi-Fi changed.

The app remained open.

The card stayed locked.

That continuity mattered because urgent banking actions rarely happen beside a stable home router. They happen in airport queues, hotel lobbies, taxis and railway stations—places where the network can change before the problem is fully resolved.

The smaller app did not merely pass the first warning.

It remained useful until there was nothing left for the thief to spend.

The bank still performed every important check

Using a route the app accepted did not remove the bank’s security.

Face ID was still required.

I still had to review each unfamiliar charge.

The replacement-card request still needed confirmation.

That was exactly what I wanted.

The VPN did not need to hide my identity from the bank or bypass its transaction controls. It needed to carry a legitimate customer to those controls without becoming the reason access was denied.

The bank and VPN had different jobs.

The bank verified me and decided what actions were allowed.

The VPN protected the connection carrying those decisions over an unfamiliar network.

A useful setup allowed both to work at once.

That distinction also prevented the wrong conclusion. A VPN should never make someone more willing to approve a payment they do not recognise. It should make it possible to reach the bank safely enough to reject it.

When disabling the VPN is only a fallback

If a banking app explicitly blocks a VPN and the task is urgent, turning it off may restore access. On trusted mobile data or a private home network, that can be a reasonable fallback.

It should not become a universal rule.

On airport, hotel or café Wi-Fi, disabling the VPN removes the private route from the entire device unless the user changes networks first.

Split tunnelling is narrower, but it still excludes the banking app itself.

The better result is a connection the app accepts while keeping its biometric and fraud checks intact.

That standard is easy to measure.

The app must open.

The security alert must load.

The transaction must be reviewed.

The card must lock.

Anything less is only a green shield.

I did not have to choose between privacy and the lock button

The smaller service has fewer locations and a shorter public history than the largest VPN providers.

Neither limitation mattered at the airport.

The established provider gave me several nearby servers and familiar controls. The banking app blocked one route, ended another session and froze before the card controls loaded on a third.

Turning the VPN off made the app work by removing the tunnel.

Split tunnelling made it work by excluding the bank.

The smaller app kept the whole phone protected, preserved the bank’s normal identity checks and stayed connected while the airport network changed.

When I reached the gate, another notification appeared.

It was not a fourth purchase.

It was the bank confirming that the card could no longer be used.

I had started the walk wondering whether banking required me to turn off the VPN.

I reached the gate with a locked card and a VPN that had finally stopped competing with the bank’s security.