Public Wi-Fi banking safety: real risks vs decade-old advice

When correctly established with the genuine service, HTTPS/TLS protects the content exchanged against a passive observer on the local network. Network operators may still observe connection metadata; the exact visibility depends on the service and configuration. Do not assume every banking app implements certificate pinning or that an app is always safer than the bank’s genuine website.

A lookalike website can also have valid HTTPS for its own domain. Open your installed official bank app or a saved, verified address instead of a link in a Wi-Fi portal or message. A certificate warning can reflect an attack or a configuration problem: neither is a reason to continue entering financial information.

Ask the venue for its actual network and access process. If available and affordable under your plan, your own mobile data avoids relying on that access point. Confirm Wi-Fi is disconnected when you intend to use cellular data. A personal hotspot also needs a strong password and your control of the sharing device.

A hotel may request a room number and surname, but verify the portal before sharing those details. A paid Wi-Fi service may legitimately use a checkout; a demand to pay to “activate free Wi-Fi” needs independent confirmation. Do not install a root certificate, unknown app or management profile to get guest access. A low-limit virtual card does not make an unverified portal legitimate.

Update your operating system, browser and banking apps. Disable automatic joining of unfamiliar open networks and unnecessary sharing or discovery. Use a screen lock and shield passcodes from nearby people. Do not bank from a hotel business-centre computer: changing the network does not remove software installed on someone else’s device.

Use a password manager and supported multi-factor authentication. Unexpected refusal to autofill is a reason to inspect the address, not to paste the password manually without checking. Match the bank’s supported methods; do not delete working SMS access assuming every bank accepts authenticator codes. Keep account recovery available separately from the phone.

A properly configured VPN encrypts traffic carried through its tunnel to the VPN server. It does not guarantee that every app or DNS request uses that tunnel, and it does not fix phishing, malicious software or an unsafe endpoint. Follow any employer-managed device policy.

If a bank refuses access, the cause is not established just because a VPN is active. Use official support and a normal permitted connection to troubleshoot. Do not rotate countries or disguise residence to bypass eligibility, sanctions or security checks. A home-country exit is not a guarantee of access.

Example: a hotel portal says your card is blocked and links to a “bank verification” page. Close it and open the bank independently; changing to mobile data while staying on that fake page does not solve the problem. Check the recipient, amount and currency before every approval. Approve only the operation you initiated.

For crypto, compare the full destination address with a trusted source, not just its first and last characters or a recent transaction-history entry. Check the network, asset and any required memo, and review the hardware wallet’s own display before signing. A hardware wallet does not make a malicious contract approval safe. Card refunds or fraud recovery are not guaranteed either.

Stop using the suspect page. From a trusted device and route, contact the relevant bank or provider immediately if payment details, credentials or funds may be exposed. Follow its card-freeze, account-security and transaction-reporting process. Preserve the address, messages, times and transaction reference without opening suspicious attachments again.

If you installed an unknown profile or software, avoid further sensitive activity on that device and seek trusted technical assistance. Do not send credentials or money to an unsolicited “recovery” helper. Recovery options and reporting deadlines depend on the actual transaction and jurisdiction.