VPNs Explained: Do You Really Need One?

Quick answer: A VPN (virtual private network) encrypts your connection and hides your IP address from the sites you visit, which helps on public Wi-Fi and keeps your internet provider from seeing which sites you visit. It does not make you anonymous, stop phishing or malware, or protect you from a company that tracks you through your logins. Most people don’t need one at home. If you do use one, the provider matters more than the brand name: you are moving your trust from your internet provider to the VPN company, and some free apps have turned out to be worse than no VPN at all.

VPN ads promise everything from “total privacy” to “unhackable” browsing. The reality is narrower, and knowing the narrow version helps you decide whether to pay for one.

A Real Example: When VPN Apps Became the Threat

On May 29, 2024, the U.S. Justice Department announced it had dismantled the “911 S5” botnet, which it described as likely the world’s largest. According to the Justice Department, the administrator, YunHe Wang, allegedly spread malware through VPN programs such as MaskVPN and DewVPN, and through bundles of pirated software, compromising millions of residential Windows computers. The devices were linked to more than 19 million unique IP addresses, including 613,841 in the United States, across nearly 200 countries, according to the FBI Director.

The government alleges Wang earned about $99 million selling access to those hijacked addresses, which criminals used to hide their own activity. The Justice Department says the botnet was used in fraud that included roughly 560,000 fraudulent unemployment claims and a confirmed loss exceeding $5.9 billion. Wang was arrested May 24, 2024, and is charged with conspiracy to commit computer fraud, wire fraud, and money laundering. The release notes that an indictment is only an allegation and that defendants are presumed innocent until proven guilty. U.S. Department of Justice, “911 S5 Botnet Dismantled and Its Administrator Arrested in Coordinated International Operation” (May 2024).

The lesson isn’t that every VPN is dangerous. It’s that a VPN app has deep access to your device and your traffic, so installing the wrong one is a bigger risk than going without. The FTC made the same point in a 2018 business blog: “The fact that an app promises security or privacy doesn’t necessarily make it trustworthy,” and “Not all VPN apps actually encrypt your information.” FTC, “In the market for a VPN app?” (February 2018).

What a VPN Actually Does

Without a VPN, your traffic travels from your device through your home or public network to your internet provider and on to the website. With one, the traffic is encrypted and sent to the VPN company’s server first. In practice:

• The network you’re on can’t read your traffic. This is useful on a café or airport network you don’t control.
• Your internet provider sees that you’re using a VPN, but not which sites you visit inside it.
• Websites see the VPN server’s IP address, not yours, which can hide your rough location.
• You can appear to be in another region, which is how people reach content or prices tied to a location.

What a VPN Doesn’t Do

• It doesn’t make you anonymous. Websites still recognize you through cookies, logins, and your browser’s fingerprint. See cookies and privacy and how to turn off hidden tracking on your phone.
• It doesn’t stop phishing, scams, or malware. A fake bank page is just as fake through a VPN. See 5 quick ways to spot a phishing email.
• It doesn’t fix weak passwords. Use a password manager and two-factor authentication.
• It doesn’t remove the need for HTTPS, though most sites now use it. See why HTTPS matters.
• It moves trust rather than removing it. The VPN company can see what your provider used to see. If it keeps logs, so can anyone who gets them.

Do You Need One?

This table is our own guidance, not drawn from a single source. For public networks in particular, see our public Wi-Fi safety guide, which covers fake networks and what else to do before you connect.

How to Choose One Safely

Treat a VPN like any app that handles your data:

1. Avoid free VPNs from unknown makers. A product has to make money somehow. The 911 S5 case shows one way: your device becomes the product. Free tiers from established companies are a different matter, but read the privacy policy.
2. Pick a company with a clear owner and a clear business model. An unknown developer with no named company is a red flag.
3. Read the logging policy, and treat “no logs” as a claim to check, not a fact. Independent audits help, but check who did the audit and when, and what it covered.
4. Use official stores only, and check the developer name matches the company.
5. Avoid VPNs bundled with other software or offered through pirated downloads.
6. Check what the app asks for. A VPN needs network permissions, not your contacts or photos.

If a VPN is doing its job, the connection should still work normally, and the company should state clearly who runs it and how it’s paid for.

If You Installed a Suspicious VPN or Free App

1. Uninstall it, and remove any browser extension from the same company.
2. Run a full scan with your security software. See our antivirus guide.
3. Change passwords from a different, clean device, starting with email and financial accounts, and turn on multi-factor authentication.
4. Watch your accounts and statements for activity you don’t recognize.
5. Report it at ReportFraud.ftc.gov or ic3.gov if you lost money or think your device was used for crime.

People Also Ask

Sources: U.S. Department of Justice, “911 S5 Botnet Dismantled and Its Administrator Arrested in Coordinated International Operation” (May 2024); Federal Trade Commission, “In the market for a VPN app?” (February 2018)