Don’t Use Public Wi-Fi Until You Read This

Free Wi-Fi is everywhere: coffee shops, airports, hotels, waiting rooms. It is convenient, and it is also one of the easiest places for someone to set a trap.

The good news is that public Wi-Fi is safer than it used to be. Most websites and apps now encrypt traffic with HTTPS, so a stranger on the same network cannot simply read your passwords as they go by. The FTC’s own guidance, Are Public Wi-Fi Networks Safe?, makes the same point, with an important caveat: encryption only protects the trip. If the site at the other end is a fake, the padlock in your address bar will not save you.

So the real risks on public Wi-Fi today are less about eavesdropping and more about being tricked: connecting to the wrong network, signing in on the wrong page, or leaving your device open to everyone else in the room.

What can still go wrong

The evil twin problem

Anyone can set up a hotspot called “Airport_Free_WiFi” or copy the name of the cafe’s network. Connect to it, and the attacker controls your connection. They may show you a convincing sign-in page, push you toward fake versions of popular sites, or simply watch which services you use to plan a more targeted scam later.

Your device makes this easier than it should be. Phones and laptops remember networks by name and will often reconnect automatically to anything that uses a familiar one. That is how you can end up on a stranger’s hotspot without ever tapping “join.”

On public Wi-Fi, the network name is just a label. Anyone can print that label.

Other risks

• Captive portal phishing: Fake “sign in with your email or Microsoft account” pages harvest credentials. A legitimate hotspot should never need your work password.
• Unpatched devices: Laptops with outdated software are exposed to others on the same network.
• File sharing left on: Network discovery and shared folders meant for the office are visible to everyone on the cafe network.
• Shoulder surfing: The person at the next table can often see more than any hacker could intercept.
• Public charging stations: Use your own charger plugged into a wall outlet rather than an unknown USB port.

A realistic scenario

Two networks with the same name

Picture a consultant at an airport gate with forty minutes to kill. Two networks show up: “Airport Free WiFi” and “Airport_Free_WiFi.” She taps the one with the stronger signal. A page appears asking her to sign in with her Microsoft 365 account “to verify she is a traveler.” It looks official, and she is in a hurry.

That page belonged to the laptop in a backpack two rows over. The fix would have taken seconds: use her phone’s hotspot instead, or notice that no airport needs her work password to hand out free internet. With phishing-resistant MFA on her email account, even a stolen password would not have been enough.

How to use public Wi-Fi safely

• Prefer your phone’s hotspot: Cellular data is encrypted and far harder to impersonate. For work, it is the best default.
• Confirm the network name with staff or signage before connecting, and be wary of duplicates.
• Never enter work or email passwords on a Wi-Fi sign-in page. Room number, last name or a simple “accept” button is normal. Your Microsoft or Google password is not.
• Check for HTTPS and use apps you already trust rather than following links.
• Turn off auto-join for public networks, and “forget” them when you leave.
• Mark the network as public: On Windows, choose the Public network profile so file sharing and discovery stay off.
• Use a trusted VPN for work, ideally the one your company provides.
• Keep your device updated and your firewall on.

Business tip: If employees travel or work from cafes, provide a company VPN or hotspot-capable phones, and require multifactor authentication on email and remote access. It removes most of the risk in one step.

Hotel Wi-Fi is not much better

Hotel networks feel more private because you have a room number and a password, but everyone in the building shares that password. Treat hotel Wi-Fi exactly like the cafe: use your hotspot or VPN for anything work-related, keep sharing turned off and do not plug work laptops into the room’s spare Ethernet port or smart TV.

If you travel often, a small travel router that connects to the hotel network and creates your own private Wi-Fi for your devices is a worthwhile upgrade, especially when you are carrying a laptop, a phone and a tablet.

What about VPNs?

A VPN encrypts everything between your device and the VPN provider, which adds a layer of protection on networks you do not trust. For business use, the company’s own VPN or secure access service is the right answer. For personal use, choose a reputable paid provider; a free VPN has to make money somehow, and often that means your data. A VPN also does not make a fake website real, so the rest of this checklist still applies.

For employers

If your team travels or works from cafes, give them a simple rule and the tools to follow it: a company VPN, phones with hotspot allowances and MFA on every account. Make sure everyone knows the most important lesson from spotting phishing: a login page is only as trustworthy as the address it came from.