Free Wi-Fi in airports, hotels, cafes and trains is one of the great conveniences of travel, but it is also one of the easiest places for someone to steal your information. On an open network, anyone nearby with basic tools can try to watch your traffic, redirect you to fake websites or trick you into joining a fake hotspot. You do not need to be a security expert to protect yourself. A few habits, a trusted VPN and the right settings on your phone and laptop make public Wi-Fi much safer. This guide explains the main risks, how to spot a suspicious network, what you should and should not do on public Wi-Fi, how to protect your accounts and devices and what to do if you think you were hacked.
In this guide:
- The main risks
- How to spot a fake or unsafe network
- Simple rules for public Wi-Fi
- Using a VPN
- Device settings that help
- Protecting your accounts
- Safer alternatives
- Hotel and airport Wi-Fi
- What to do if something goes wrong
- FAQ
The Main Risks
The biggest problem with open public Wi-Fi is that the data may not be protected between your device and the router. Several things can go wrong:
- Eavesdropping: On unencrypted networks, an attacker can capture data such as the sites you visit and, if a website is not secure, information you enter.
- Fake hotspots: Criminals set up networks with names such as Airport Free Wi-Fi or Hotel Guest, and capture the data of anyone who connects. This is sometimes called an evil twin attack.
- Man-in-the-middle attacks: The attacker sits between you and the website, and can read or change what passes through.
- Malware: Fake login pages or pop-ups can trick you into downloading harmful software.
- Weak or shared passwords: A network password written on a wall is shared with everyone, including bad actors.
Most websites today use encryption, shown by a padlock and https in the address, which gives strong protection for the content of your communication. Even so, you should stay careful, because the network can still see which sites you visit, and some apps and pages are less secure.
How to Spot a Fake or Unsafe Network
Always ask the staff for the exact network name and password. Be suspicious if two networks have similar names, if a network with no password has a strong signal in a place where you do not expect one, or if a login page asks for unusual information such as your email password, card details or a download. A genuine hotel or cafe network may ask for your room number or an email address, but never your bank details. If you see a browser warning about an invalid certificate, stop and disconnect. Turn off your phone’s setting that automatically joins open networks, because it may connect you to a fake one without asking.
Simple Rules for Public Wi-Fi
- Do not do banking or shopping on public Wi-Fi unless you use a VPN or your mobile data.
- Only use https sites and look for the padlock icon.
- Do not enter passwords on websites you do not trust, and avoid logging into sensitive accounts.
- Turn off file sharing and AirDrop or set it to contacts only.
- Do not install software or updates from pop-ups on a public network.
- Log out of accounts and forget the network when you finish.
- Keep Bluetooth off when you do not need it.
Save sensitive tasks for your hotel room with a secure connection, or use your own mobile data, which is encrypted and much harder to intercept.
Using a VPN
A virtual private network encrypts your internet traffic and sends it through a secure server, so the local network cannot see what you are doing. It is a good extra layer on public Wi-Fi, especially when you must access email, work accounts or banking. Choose a well-known, paid VPN with a clear privacy policy rather than a free one, which may collect and sell your data. Check that it has a kill switch, which stops your internet if the VPN drops, and apps for all your devices. A VPN does not make you invisible or protect you from phishing, and it may slow your connection or be restricted in some countries, so check local laws before travelling.
Device Settings That Help
- Keep your operating system and apps updated, since updates fix security holes.
- Turn on the firewall on your laptop, and select the Public network profile when you connect.
- Turn off automatic connection to open networks, and delete saved networks you no longer use.
- Use a strong screen lock, with a long passcode or biometric option, and enable find and wipe my device.
- Install a trusted security app on your laptop and keep it updated.
- Set your browser to warn you about unsafe websites, and avoid saving passwords in shared computers.
Protecting Your Accounts
Use a password manager to create long, unique passwords for each account, and turn on two-factor authentication wherever it is available. Prefer authenticator apps or hardware keys to text messages, which can be hard to receive abroad and easier to intercept. Review account activity and login alerts. Set a PIN on your SIM card to prevent SIM swap attacks. Keep recovery email addresses and phone numbers current. Back up your data so that you can recover if a device is lost or compromised, and avoid logging into your accounts on computers in hotel business centres or internet cafes.
Safer Alternatives
The safest way to go online while travelling is your own mobile data. A local SIM or a travel eSIM gives you an encrypted connection to the mobile network, and you can share it as a hotspot with your laptop if needed. If you do use a hotspot, set a strong password and a non-obvious name. Our guides on how to use an eSIM when traveling and the best ways to get internet abroad explain the options.
Hotel and Airport Wi-Fi
Hotel Wi-Fi is usually safer than a random open network, but it is shared by many guests. Ask the front desk for the correct network name, avoid connecting to similarly named networks and use a VPN if you handle sensitive work. In airports, check the official network name on information boards or ask staff, and avoid networks that require you to install an app or give a lot of personal information. Charge your devices from your own charger and power bank, rather than public USB ports, which can be risky because of data theft, a practice sometimes called juice jacking.
What to Do If Something Goes Wrong
- Disconnect from the network and turn off Wi-Fi.
- Change the passwords of important accounts from a secure device, starting with email and banking.
- Check your bank statements and contact your bank or card issuer if you see suspicious transactions.
- Run a security scan on your device and remove anything you do not recognise.
- Enable two-factor authentication if it was not on.
- Report the incident to your accommodation or the network owner if it happened on their network, and to the police if you lost money.
FAQ
Is it safe to use public Wi-Fi for social media?
It is lower risk than banking, but use a VPN or mobile data, enable two-factor authentication and avoid logging in on shared computers.
Does https make public Wi-Fi safe?
Https encrypts the content between you and the website, which is a strong protection, but the network can still see which sites you visit, and fake hotspots can show you deceptive pages.
Should I always use a VPN?
It is a good habit on any public network, and it is especially important for work or financial accounts.
Are password-protected networks safe?
They are better than open networks but not always safe, because everyone shares the same password.
Can someone hack my phone just by being on the same Wi-Fi?
It is unlikely if your phone is updated and your settings are secure, but you should avoid risky behaviour such as installing unknown apps.
Planning your next trip? Read our guide to cheap flights and accommodation.
