Border control AI in 2026. The new questions, the new flags, the new refusals.

What changed in the last three years

Three structural shifts have reshaped border screening since 2023, none of them visible from the traveller’s side until the questioning actually starts.

The first is automated pre-screening. The Advance Passenger Information that airlines transmit to destination governments now feeds AI risk-scoring systems before the flight lands. CBP’s Automated Targeting System has run for years; the 2024 expansion adds machine-learning models that ingest social media indicators, travel pattern anomalies, and financial signals. EU equivalents (the Entry/Exit System rolled out in stages through 2024 and 2025, and ETIAS becoming mandatory for visa-exempt travelers) feed similar scoring infrastructure.

The second is biometric-first inspection. Facial recognition at airline boarding gates and at primary inspection booths matches your face against the photograph on your travel document and against a watch list database. The match returns a score. A score below threshold sends you to secondary. The traveler does not see the threshold. The officer at the counter does not always see it either.

The third is device-aware questioning. The questions border officers ask have shifted to include device-specific signals. “Do you have a work phone and a personal phone?” “What encrypted messaging apps do you use?” “Have you used a VPN to connect to email in the last seven days?” The answers are rarely verifiable on the spot, but the pattern of answers feeds directly into the secondary-inspection decision.

The new flags that send travelers to secondary

The traditional flags (mismatched travel history, prior immigration violations, watch-list matches) still apply. The newer flags are less obvious.

Recent purchase of a one-way ticket on a route that historically attracts asylum claims. Travel pattern that resembles a courier profile (frequent short trips to specific source countries). Social media language that triggers the political-violence classifiers, regardless of context. A name match to someone of investigative interest in a database the officer does not name. Last-minute itinerary changes that the airline reports to the destination government before takeoff.

For some categories of travelers, the flag list is broader. Journalists covering certain regions, activists with public profiles in certain causes, researchers in dual-use technology fields, and lawyers traveling to meet clients in jurisdictions of interest all face elevated screening as a default. The screening is sometimes documented in agency policy. Often it is not.

The new questions in secondary inspection

Three categories of question have become standard in secondary inspection over the last two years.

Device questions

“Please unlock your phone.” The question is older than the AI overlay. The legal answer varies by jurisdiction. At the US border, CBP can request a device search, and the legal posture is that compliance is generally expected for foreign nationals while US citizens have stronger refusal rights. Refusal at the US border by a US citizen results in detention of the device, not denial of entry. In the UK, Schedule 7 of the Terrorism Act provides a separate framework with broader powers and narrower refusal rights.

The follow-up questions matter as much as the unlock request. “What apps do you use to communicate with people in country X?” “Do you have a separate phone for work?” “What email accounts do you use?” The answers go into the record. The refusal to answer is itself a record point.

Social media questions

“What is your handle on Twitter or X?” The disclosure has been a US visa-application requirement since 2019 and has expanded into secondary inspection for travelers who did not complete a visa application (visa-waiver travelers, returning legal residents, US citizens with elevated screening). The list of platforms you are asked about is longer than it was. TikTok, Telegram, and several smaller platforms now appear in the standard set.

Financial questions

“Are you carrying more than $10,000 in cash or equivalent?” The classic question is now augmented. “Do you hold cryptocurrency? In what amount? On what platforms?” Currency reporting law applies to digital assets in some jurisdictions. The reporting threshold and the practical questioning vary. The conservative posture is to be ready to answer the question accurately, or to decline cleanly if you are not.

The pre-departure preparation that matters

Decide your device posture before you arrive at the airport

The decision does not happen at the counter; it happens when you packed. For most travelers, the regular phone is fine. For travelers in the elevated-screening categories, a travel device that is genuinely separate from the daily-driver device reduces the surface of what is producible at the border. The travel device runs the apps you need for the trip and nothing else. The personal accounts, the work email, the historical messaging archives, the cloud-stored documents are not on it. The framework for the device-compartmentation logic is the same one we cover in operational identity separation.

Audit your social media and your public presence

Whatever is publicly accessible has, in effect, already been screened. The audit is for two purposes: to know what the officer can see, and to remove anything that is publicly accessible but does not need to be. Old posts that have aged poorly. Public photos of activities that, while legal, will be context for questions. The audit is not censorship of legitimate speech; it is being intentional about what is the public-facing version of you.

Know your refusal rights, by jurisdiction

The refusal rights vary. US citizens at the US border can refuse a device search at the cost of device detention but cannot be denied entry. Foreign nationals at the US border can be denied entry for refusing a device search. In the UK under Schedule 7, refusal is a criminal offense. In the EU, framework varies by member state. Read your specific case before you travel. The framework around what answers are obligatory and what answers are discretionary is jurisdiction-specific. The piece on cross-border data requests covers some of the underlying legal infrastructure.

If you are sent to secondary

How you handle yourself procedurally tends to matter more than the substance of any individual answer.

Stay calm and brief. The officer is observing demeanour as part of the assessment, and polite, consistent, short answers reduce the duration of the interview, while long answers create new threads to investigate.

Do not lie. The records the officer is comparing your answers against include data you may not know they have. A lie that is detected against the record produces a much larger problem than the truth would have produced.

Document the encounter when you are out. The badge number of the officer (usually displayed). The duration of the secondary inspection. The questions asked. The answers given. The names of any documents reviewed. The same documentation hygiene we cover in why your security setup fails in the field applies to border encounters: the contemporaneous record matters if there is later legal action.

Know when to ask for a lawyer. For US citizens, you have the right to refuse questioning beyond your identity and your right to enter the country. For foreign nationals, the right to counsel at the border is narrower. For travelers in elevated-risk categories, retaining counsel before travel and having their contact information accessible is the standard precaution.

Frequently asked questions

Should I wipe my phone before crossing the border?

Generally no. A wiped phone is itself a flag. The cleaner approach is a travel-specific device that has only what is needed for the trip. The travel device looks normal because it is normal. A daily-driver phone wiped immediately before a border crossing looks suspicious because it is suspicious.

What about Signal, Telegram, and WhatsApp?

The mere presence of an encrypted messaging app on a phone is not a flag in most jurisdictions. The use of these apps is widespread enough that their presence is not unusual. The questions tend to focus on the contacts and the substance, not the existence of the app. Disappearing-message settings reduce the historical archive on the device. Cloud backup of the message history reintroduces the exposure if the cloud account is also accessible. Device-side hygiene matters, but the cloud-backup question is the larger gap that most travellers miss before they leave.

Are journalists treated differently at the border?

Sometimes, in both directions. Some jurisdictions have policy frameworks that protect journalist material from the most invasive searches. Others treat working journalists as elevated-risk travelers and apply additional screening. The Reporters Committee for Freedom of the Press maintains current guidance for US journalists; equivalent organizations in other jurisdictions provide the local picture. Get current advice before traveling on assignment.

If I am denied entry, what happens to my data?

The data captured during the inspection is retained by the screening authority under their retention policies, which in most cases are measured in years. Denial of entry does not produce automatic data deletion. That retention is one of the reasons pre-departure preparation matters: whatever you bring to the border becomes part of the long-term record regardless of whether the trip itself proceeds.

---

There’s no perfect setup. Anyone selling you perfect is selling fear. The goal is simple: make yourself a harder target than the person next to you.