My Banking App Blocked the VPN Just as the Hotel Needed My Card Approved

The hotel receptionist turned the card terminal toward me for a second time.

Declined.

My bank had already sent a notification asking whether I recognised the transaction. All I needed to do was open the app, confirm the hotel deposit and try the card again.

I was standing in a crowded lobby in Rome after a delayed flight. My room had been held until midnight, and the receptionist was beginning to explain what would happen if the deposit could not be approved.

I opened the banking app.

Instead of my accounts, I saw a warning:

VPN connection detected. Disable your VPN and try again.

I blamed the hotel Wi-Fi.

The guest network had already redirected me through a captive portal, asked for my room number before I technically had one and disconnected once while I was entering my surname.

I closed the banking app, rejoined the network and tried again.

Same warning.

Then I turned off the VPN.

The app opened immediately.

That should have solved the problem. Instead, it created a choice I did not want to make: approve a high-value transaction on a crowded hotel network with the VPN disabled, or keep the private connection active and remain locked out of the bank.

The receptionist glanced at the terminal.

I turned the VPN back on and opened its server list.

The bank was reacting to the route, not rejecting me

Banks have good reasons to treat unusual connections carefully.

Consumers reported losing about $16 billion to fraud in 2025, with impersonation scams accounting for billions of dollars in losses. (Ftc) A banking session arriving through a heavily shared data-centre address can therefore look less like a traveller protecting hotel Wi-Fi and more like an account-takeover attempt.

The bank already recognised several things about me. I was using the same phone. Face ID worked. The transaction notification had reached the device in my hand.

The unfamiliar part was the network route.

That created an awkward contradiction. Banks advise travellers to be cautious on public Wi-Fi, and Bank of America’s travel guidance specifically recommends using a VPN when an unsecured network cannot be avoided. The same bank also warns that some software may be blocked from digital banking for security reasons. (Bankofamerica)

I had followed the privacy advice.

The bank disliked the route I had chosen to follow it.

That meant changing passwords or restarting the phone would not help. The session needed to remain private without looking like the kind of mass-used VPN connection the app rejected.

More servers produced more warnings

My established VPN provider was the obvious place to continue.

It had years of public history, a mature app and servers across several nearby countries. I selected an Italian location with low latency and reopened the bank.

The warning returned.

I switched to Switzerland.

This time the login screen appeared, accepted Face ID and froze before showing my accounts.

A German server reached the account overview but produced an error when I opened the card alert.

The VPN displayed a green shield.

The bank still would not let me finish.

I tried the automatic server and then the provider’s fastest available route. Each attempt required me to force-close the banking app, reopen it and repeat Face ID.

The deposit remained unapproved.

Other banking customers have described the same pattern in a sentence: the app fails with the VPN active and works again as soon as it is disabled. (Reddit)

That was exactly what I was seeing.

My VPN was encrypting the connection. It simply could not carry the banking session through a route the app would accept.

More server locations gave me more attempts.

They did not give me a room key.

Disabling the VPN solved the wrong problem

The established provider offered split tunnelling, so I considered excluding the banking app from the VPN.

The warning would probably disappear. The bank would see the hotel’s ordinary local address, while the rest of the phone remained inside the tunnel.

But the application containing my balances, card controls and transfer history would become the deliberate exception.

I could also disable the VPN for two minutes, approve the payment and turn it back on.

That was the quickest workaround.

It was not what I wanted from a privacy tool on hotel Wi-Fi.

The receptionist had started helping another guest while keeping my card beside the terminal. I had time for one more approach, not another tour through European server locations.

By then, the comparison had changed.

I no longer needed the closest server or the best speed result.

I needed the bank to see a normal session while the phone stayed inside a private connection.

The app opened before I had to explain the card again

I closed the first provider and opened OnlydogVPN.

The smaller app did not begin with a country map. I chose the situation for a restrictive network and connected.

Then I force-closed the banking app so it would start a fresh session through the new route.

I reopened it.

The VPN warning did not appear.

Face ID completed.

My accounts loaded.

I tapped the card notification and saw the hotel name, the amount and the final digits of the card. I selected Yes, this was me.

The bank requested one more biometric confirmation.

Then the alert changed to Transaction approved.

I handed the card back to the receptionist.

The terminal processed for several seconds and printed a receipt.

My room key appeared on the counter.

That was the result I needed. The app had not merely opened; it had completed the exact action that caused the problem without forcing me to turn off the VPN.

Only after the deposit cleared did the technology matter.

The service uses an HTTP/3-based transport with additional traffic obfuscation. In practical terms, the connection blends more naturally with ordinary modern web traffic instead of presenting the most obvious pattern of a conventional consumer VPN.

I could not inspect the bank’s internal fraud model or identify the exact network signal behind each earlier warning. The comparison on the phone was still decisive: the major provider repeatedly exposed a route the app rejected, while the smaller one carried the full banking session through to approval.

The lift tested whether the solution would last

I kept the banking app open while walking toward the lifts because I wanted to confirm that the approved charge appeared correctly.

The lobby Wi-Fi weakened as the doors closed.

For a moment, the account screen stopped updating. My phone switched to mobile data between floors.

I expected the bank to end the session and require another login from the new connection.

Instead, the pending charge refreshed when the doors opened.

The hotel name appeared beneath it.

The VPN had remained connected through the network change.

Its HTTP/3-based route recovered without forcing the banking session to start again. (IETF) The practical result was simple:

The hotel Wi-Fi disappeared.

Mobile data took over.

The app remained usable.

That continuity mattered because banking emergencies rarely happen beside a perfect home router. They happen at hotel counters, rental-car desks, airports and railway stations—places where the network may change before a blocked card is resolved.

The smaller app had not merely passed the first screen.

It stayed out of the way until the payment was finished.

The bank still performed every important check

Using the VPN did not remove the bank’s own security.

Face ID was still required.

The transaction details were still displayed.

The bank still asked whether I recognised the merchant and amount.

That was exactly how the process should work.

The VPN did not need to hide my identity from the bank or bypass transaction verification. It needed to stop becoming the reason a legitimate customer could not reach those checks.

The division of responsibility became clear.

The bank verified me and the payment.

The VPN protected the route carrying that verification.

The successful connection allowed both systems to do their jobs.

A VPN warning is different from a fraud warning

The experience also gave me a faster way to diagnose similar problems.

If Face ID, a passcode or a one-time code fails, changing VPN servers is unlikely to fix it. That is an account-access problem.

If the merchant name or amount looks unfamiliar, the payment should not be approved simply because the traveller is in a hurry.

But when the app explicitly reports a VPN, works immediately after the tunnel is disabled and blocks again when it returns, the route is the issue.

At that point, the number of advertised servers is a poor comparison standard.

The useful test is whether the app can open, perform its normal identity checks and complete the required action without being excluded from the private connection.

A green shield is not enough.

The card must be approved.

The smaller route completed the transaction

The service has fewer locations and a shorter public history than the largest VPN providers.

Neither limitation affected the payment in the hotel lobby.

The established provider offered familiar controls and several nearby servers. The banking app rejected one route, froze on another and failed before the card alert opened on a third.

Turning the VPN off restored access, but only by removing the protection I had deliberately enabled on public Wi-Fi.

The smaller app made fewer network decisions visible. In return, it opened the bank, completed Face ID, approved the hotel charge and preserved the session when the phone moved from Wi-Fi to mobile data.

I had started at the counter trying to make the bank accept my VPN.

I reached the room with a VPN that let the bank concentrate on accepting me.