Staying safe when using public Wi-Fi

As many as 69% of internet users in the UK connect to public Wi-Fi networks at least once a week, according to a 2023 survey.¹ But the prevalence and convenience of Wi-Fi do not address the underlying question: Is public Wi-Fi safe?

Comparing public and private Wi-Fi security

Public and private Wi-Fi networks have important differences when it comes to security. Public Wi-Fi networks, commonly found in cafes or airports, are typically open and unsecured. These networks allow anyone to connect without a password, leaving users vulnerable to attacks like data interception or malware distribution.

Private Wi-Fi networks, on the other hand, are password-protected and usually set up at home or in a secure workplace. These networks provide an additional layer of security by restricting access to unauthorised users, making them far safer than their public counterparts. For this reason, it is always advisable to avoid transmitting sensitive data over public Wi-Fi — unless a security measure, such as a virtual private network (VPN), is being used.

Understanding the security risks of public Wi-Fi

Most public Wi-Fi networks have weak security. When a Wi-Fi network is unsecured, cybercriminals can easily access data transmitted over the network, potentially leading to identity theft, financial fraud, or other cyberattacks. These are referred to as man-in-the-middle attacks. Weak security systems also leave devices vulnerable to malware, which can be installed without the user’s knowledge.

While it can be tempting to take advantage of the convenience of public Wi-Fi, understanding its risks is crucial to keeping personal data safe.

Protecting against man-in-the-middle attacks

A man-in-the-middle attack is one of the most dangerous threats associated with unsecured public Wi-Fi networks. During these attacks, cybercriminals intercept communication between two parties — often between a user and a website — to steal sensitive data. Information like login credentials, credit card details, and personal messages are particularly vulnerable.

Users can protect against man-in-the-middle attacks by not entering sensitive information when connected to public Wi-Fi, using websites with HTTPS encryption, and considering a VPN for added security.

Preventing malware on public networks

Cybercriminals often exploit unsecured networks to spread malicious software, which can infect devices and compromise sensitive data. These attacks are often invisible to the user, making them particularly dangerous.

To safeguard against malware when using public Wi-Fi, it’s crucial to take proactive measures. These include ensuring all devices are equipped with up-to-date software and using reputable antivirus programs.

Guarding against phishing on public Wi-Fi

Phishing is another significant risk on unsecured public Wi-Fi networks. Hackers may create fake websites that appear legitimate but are designed to gather personal information, such as login credentials and payment details. These sites can be challenging to identify, making it important to remain vigilant.

Users can protect against phishing attacks by always checking that a website is secure — look for HTTPS in the URL and a padlock symbol in the browser. It's a good idea to double-check URLs to ensure they are legitimate before entering any personal information. PayPal's guide on how to detect and avoid phishing provides more information.

Best practices for safe browsing and shopping on public Wi-Fi

It's important to use public Wi-Fi in a way that ensures — as much as possible — safe browsing and shopping. That includes not accessing sensitive accounts or inputting personal information unless absolutely necessary. Because of the weak security on public Wi-Fi, users may want to focus on browsing less sensitive websites and use secure methods for online shopping, such as PayPal’s safe checkout option, which adds a layer of protection for online transactions.

Conducting sensitive transactions securely

Performing sensitive transactions over public Wi-Fi is risky. This includes online banking or shopping. Hackers on unsecured networks can intercept data, potentially leading to identity theft or financial loss. Before conducting any transaction that involves personal data, public Wi-Fi users may want to ensure the network is secure by checking for encryption protocols or switching to a more secure connection.

To stay safe, it’s advisable to avoid using public Wi-Fi for these activities altogether, waiting instead to be on a secure, private network, like one at home or work.

The importance of using VPNs on public Wi-Fi

A VPN is a powerful tool for enhancing security when using public Wi-Fi. VPNs work by encrypting an internet connection, creating a secure tunnel between a device and the websites being visited. This means that any data being sent or received is protected from potential hackers who might be lurking on the same public network. By encrypting data, VPNs significantly reduce the risk of man-in-the-middle attacks and other forms of cyber threats.

When using a VPN, it's important to ensure that it’s active when connecting to an unsecured public Wi-Fi network. While VPNs are highly effective at protecting a user's privacy and security, they don’t replace other safety measures, such as using strong passwords and being cautious about which sites to visit.

The significance of HTTPS in enhancing web security

HTTPS (hypertext transfer protocol secure) plays a crucial role in securing web connections. It ensures that the data exchanged between a user's browser and a website is encrypted, protecting it from interception by cybercriminals. When browsing on public Wi-Fi, it’s important to check for HTTPS at the beginning of the URL of each website visited. A padlock symbol next to the URL also indicates that the connection is secure.

Using websites with HTTPS can safeguard sensitive information, such as login credentials and payment details, reducing the risk of data theft. If a site lacks HTTPS, it’s best to avoid entering any personal information. Unsecured networks, especially those without HTTPS, can expose data to potential threats.