Most of What You Heard About Public WiFi Is Out of Date. One Risk Isn't.
For years the advice never changed: stay off the coffee-shop WiFi, or a stranger two tables away will pull your banking password out of the air. That was sound guidance — in about 2012.
Back then, most websites sent your information across the network as plain text. Anyone on the same WiFi with a free, easy tool could read it. Today almost every site encrypts that connection on its own. Google's own measurements put it near 95% of all web traffic, and on phones the share is higher still. The padlock beside a web address means the data leaving your device is already scrambled before it reaches the router.
The Federal Trade Commission now says so directly: because encryption has become so widespread, connecting through public WiFi is "usually safe." Your bank app on the airport network is almost certainly fine. A stranger nearby can no more read your scrambled traffic than read a sealed letter across the room.
So why are you still told to be afraid of it?
Because one risk never left. And it doesn't work the way the old warning said.
The network that isn't real
Instead of eavesdropping on a real network, an attacker today builds a fake one.
The trick has a name: the evil twin. He sets up a hotspot with a name you'd trust — "Airport_Free_WiFi," "Hotel_Guest" — and waits for you to tap the wrong one. It isn't a hypothetical. In 2024, Australian Federal Police arrested a man running exactly this scheme at airports in Perth, Melbourne and Adelaide, and on domestic flights. When travelers joined his network, a convincing free-WiFi page asked them to "sign in" with an email or social account, and passed whatever they typed straight to him. Last November he was sentenced to more than seven years.
Look at why it worked. The padlock held, and it made no difference. People typed their logins willingly, into a page that looked official, because there was no way to tell the real network from the counterfeit.
That's the real gap. Your phone can't see who owns the WiFi it's joining. And once you're on the attacker's network, he decides where your requests actually go.
What actually protects you
Two habits and one tool cover nearly all of it.
The habits cost nothing and you can start today:
- Turn off automatic connections, so your phone or laptop never joins an open network on its own. Choose the network yourself each time.
- Never enter a password on a page that asks you to "sign in to use the WiFi." A real network doesn't need your email or social login.
The tool handles the part habits can't reach. A VPN, or virtual private network, wraps everything your device sends in its own layer of encryption and routes it through a server you choose rather than whatever network you walked into. On a rogue hotspot, its operator sees only scrambled traffic heading to a single place, with no view of your accounts or the sites behind it.
A VPN won't stop you from typing a password into a fake page; only your own attention does that. What it removes is the operator's ability to watch or redirect your traffic, which is the entire payoff an evil twin is built to collect.
That's the case for keeping it simple with one tool instead of three. Total VPN packages the VPN together with an ad-blocker and antivirus in a single app, so the encrypted connection, the blocking of malicious ads, and the device scan all run from one subscription. For anyone who'd rather be covered than assemble a shelf of security products, it's the closest thing to simply having it handled.
Get Total VPN's all-in-one protection →
The café WiFi itself is fine. Your job is to join the real one — and to make sure that even if you slip, there's nothing on the line worth stealing.