Public Wi-Fi Safety: How to Protect Yourself on Airport, Café, and Hotel Networks

Quick answer: Public Wi-Fi is inherently less secure than your home network because you can’t verify who set it up or who else is on it. The single biggest protection is a VPN, which encrypts your connection so nobody else on the network can read your traffic — but verifying the network name with staff, avoiding sensitive logins, and turning off auto-connect all matter too.

Free Wi-Fi at an airport, coffee shop, or hotel feels like a small convenience — until it’s the reason someone else has your email password. Public networks are, by definition, open to strangers, which means you have no way to verify who actually controls the network or who else is quietly watching the traffic on it. That doesn’t mean you should never use public Wi-Fi. It means you should know exactly what you’re exposing when you do.

A Real Example: Fake Wi-Fi at the Airport Gate

In April 2024, Australian Federal Police arrested a 42-year-old man after airline staff flagged a suspicious Wi-Fi network appearing on a domestic flight. Investigators allege he used a portable wireless device to create fake “free Wi-Fi” hotspots — known as an evil twin attack — at airports in Perth, Melbourne, and Adelaide, and on flights themselves. The fake networks were designed to look identical to legitimate ones. When travelers connected, they were shown a fake login page asking for their email or social media credentials, which were then harvested and stored. He was charged with nine cybercrime offenses, including unauthorized access to personal financial information, and faced up to 23 years in prison if convicted.

What made this attack effective wasn’t sophistication — it was familiarity. Travelers see “free Wi-Fi” prompts constantly and rarely stop to verify which network is the real one, especially somewhere as routine as an airport gate.

How These Attacks Actually Work

• Evil twin networks mimic a legitimate network’s name (its SSID) closely enough that your device can’t tell the difference. Some public places even display their real Wi-Fi password openly, making it trivial for an attacker to clone it exactly.
• Packet sniffing lets someone on the same unencrypted network passively capture data traveling across it — logins, messages, anything not independently encrypted.
• Man-in-the-middle attacks insert the attacker between you and the site you’re visiting, letting them read or even alter traffic passing through, not just observe it.

None of these require hacking your device directly — they work by exploiting the network itself, which is exactly why they’re so hard to notice from the user’s side.

Before You Connect

1. Ask staff for the exact network name. Don’t rely on the list your device shows you — attackers often name fake networks something nearly identical to the real one (“Airport_WiFi” vs. “Airport-WiFi_Free”).
2. Turn off auto-connect for open Wi-Fi networks in your device settings, so your phone doesn’t silently join a familiar-looking network without you choosing to.
3. Disable file sharing and AirDrop-style features before connecting to any public network, so other devices on the same network can’t attempt to access yours directly.

Once You’re Connected

• Use a VPN. This is the single most effective step: it encrypts your entire connection so that even if someone is capturing traffic on the network, what they capture is unreadable. Choose a reputable, paid VPN service — free VPNs sometimes monetize by logging or selling the very data you’re trying to protect.
• Stick to HTTPS sites. Look for the padlock before entering anything. A VPN protects the connection generally, but confirming HTTPS on the specific site you’re using is still worth checking.
• Avoid banking, shopping, or entering passwords for sensitive accounts on public Wi-Fi if you can wait until you’re on a trusted network — even with a VPN, it’s the lowest-risk habit.
• Turn Wi-Fi off when you’re done. Beyond saving battery, it stops your device from automatically reconnecting to that network — or a fake one using the same name — later without you noticing.

A Safer Alternative: Your Phone’s Hotspot

If you have cellular signal, using your phone as a personal mobile hotspot for your laptop is generally safer than joining an unknown public network, since it’s a connection only you control, authenticated with your own credentials rather than shared with strangers. It’s worth defaulting to this for anything sensitive when it’s available to you.

If You Think You Were Compromised on Public Wi-Fi

1. Disconnect from the network immediately.
2. Change the passwords for any accounts you logged into while connected, starting with email and financial accounts, and enable two-factor authentication if it isn’t already active.
3. Check recent account activity on those accounts for logins or actions you didn’t make.
4. Run a security scan on your device in case anything was downloaded without your knowledge.
5. Monitor your accounts closely for the following few weeks — stolen credentials aren’t always used immediately.
6. Report it if you believe you encountered a deliberately malicious network, such as an evil twin — file a report at ic3.gov (FBI) and let the venue’s staff know, since they may not be aware a fake network is operating on their premises.

Quick Prevention Checklist

• Use a reputable VPN every time you connect to a network you don’t control.
• Verify the exact network name with staff before connecting.
• Turn off auto-connect and file sharing for public networks.
• Avoid sensitive logins and financial transactions when possible.
• Prefer your phone’s mobile hotspot for anything sensitive.
• Turn Wi-Fi off when you’re not actively using it.

People Also Ask

Sources: Australian Federal Police public statement and BleepingComputer reporting on the 2024 “evil twin” Wi-Fi arrest; NSA and CISA joint guidance on securing public and remote Wi-Fi connections