Is public Wi-Fi safe when you travel?

Why encryption changed the answer

Most of the old warnings about public Wi-Fi date from a time when many sites sent information unencrypted. Today the FTC’s position is that, because encryption is so widespread, connecting through a public network is usually safe. A padlock or https in the address bar means what you send is encrypted on its way to the site, whoever runs the network.

The FTC also points out the limit: encryption protects the connection, not the destination. Scammers build encrypted websites too, so a padlock tells you nobody in the café can read your data, not that the site is genuine. The danger has moved from the network itself to where the network, or a link, sends you.

The real risk: a network that is not what it claims

The UK’s National Cyber Security Centre puts the problem simply: when you use a hotspot in a hotel or café, there is no easy way to find out who controls it, or to prove it belongs to who you think it does. A criminal can set up a hotspot that copies the venue’s name, and if you join it, they may be able to see what you are working on and the login details that apps keep while you are signed in.

The US Cybersecurity and Infrastructure Security Agency (CISA) adds that open networks in places like airports and coffee shops give attackers a chance to intercept what you enter during online transactions. Its advice is to confirm a hotspot’s name and password before you use it; asking at the reception desk takes ten seconds and rules out the copycat next to it in the list.

When to switch to mobile data instead

Both agencies draw the same line. CISA advises against banking or shopping online over open Wi-Fi and, if you must, to turn off Wi-Fi and use your phone’s mobile data. The NCSC’s advice for sensitive work is to stay off unknown hotspots and use your mobile network, which has security built in, including tethering, where your laptop shares your phone’s connection.

In practice that means mobile data for online banking, payments, changing a booking with card details, work email and any account that would hurt to lose. Hotel Wi-Fi is fine for streaming a series or downloading maps. A data eSIM for your destination, such as Snoozim’s, makes that split easy, and our guide to sharing data with a laptop covers the tethering side.

Habits that make any Wi-Fi safer

• Keep the phone’s operating system, browser and apps up to date; the FTC and the NCSC both put this first.
• Turn on two-factor authentication for email, banking and social accounts, so a stolen password is not enough on its own.
• If you work on public networks often, use a VPN from a reputable provider; the NCSC warns against unknown ones.
• Deny file and folder sharing when your laptop joins a public network, as CISA advises.
• Look at the address bar before typing a password, especially after following a link.

None of this is complicated, and most of it is set up once before the trip rather than remembered at every café.

If something goes wrong on the trip

If you think you typed a password into a fake page, change it straight away from a connection you trust, starting with your email, because email is where most other accounts send their reset links. Then check the account’s list of signed-in devices and sign out any you do not recognise.

A lost or stolen phone is the other travel risk, and it is easier to handle if you prepared at home. The NCSC recommends setting up the free tools most phones include that let you locate the device, lock it remotely, erase its data and retrieve a backup. Check that they are switched on, and that your backup is recent, before you leave rather than after.