Public WiFi Safety: What Really Happens to Your Data
First, the part that’s better than the headlines say
Most of the internet is encrypted now. When a site shows the padlock in the address bar, the traffic between you and that site is scrambled end to end. Banking sites, email providers, social media, shopping: all encrypted. Someone sitting in the same coffee shop sniffing WiFi traffic mostly sees meaningless ciphertext, plus the list of domains you’re visiting.
So no, a stranger can’t simply “read your emails” on the same WiFi, as long as those services use HTTPS, which the major ones all do. The real risks moved elsewhere.
Risk 1: the network is lying about what it is
The most practical public WiFi attack doesn’t involve breaking encryption at all. Someone sets up their own hotspot named Airport_Free_WiFi or Mall_Guest, and phones connect to it automatically because it looks familiar or because it broadcasts a stronger signal than the real thing.
Now every page you load passes through that person’s device. Encrypted banking traffic stays unreadable, but anything you type into an unencrypted page, and any login page they choose to fake, is theirs. A convincing clone of your bank’s sign-in screen can email your credentials to the operator the moment you submit them.
This is the “evil twin” attack, and it’s cheap: a laptop or even a phone can host it.
Risk 2: your device talking to strangers
Operating systems treat networks as “private” or “public”. On a private network (your home), your computer allows file sharing, printer discovery, and similar conveniences. If your laptop joins a coffee shop network and still thinks it’s at home, those sharing features are open to everyone else in the room. File sharing, remote desktop, AirDrop set to “everyone”: all of these become doors with someone standing on the other side.
Fix: make sure your device is set to Public network whenever you’re away from home. Windows asks when you first join; macOS hides sharing behind settings; phones are mostly fine by default.
Risk 3: the captive portal
That login page where you type a room number or an email address to get online? It sits in front of everything, and it’s a data collection form as much as anything. Assume anything you type into it goes to a marketing database. Use a throwaway email address if it demands one, and never reuse a password there.
Running a guesthouse or guest WiFi at your business?
If you offer WiFi to guests, the risks run in both directions: your guests’ devices can be attacked on your network, and your business systems can be reached from theirs. The fix is network separation, a guest network that reaches the internet but not your point of sale or admin machines. We set that up for guesthouses, hotels and offices across the Helderberg as part of our business network setups.
1. Confirm the network name with staff before joining. Real “Airport_Free_WiFi” or lookalike impostor? Thirty seconds of asking beats an hour of cleanup.
2. Turn off auto-join for public networks so your phone doesn’t chase the first familiar name it sees.
3. Use a VPN for anything sensitive. It wraps your traffic in its own encrypted tunnel that no fake network can inspect. Our VPN guide explains what to look for.
4. Set your device to Public network when away from home.
5. Type nothing sensitive into captive portals.
6. When in doubt, use mobile data. Your cellular connection is separate from the coffee shop’s network entirely. Checking banking on 5G while sitting in the shop is safer than on their WiFi.
What about banking specifically?
If you must bank on public WiFi: verify the network, confirm the app or browser shows a valid certificate, and consider a VPN as a second layer. But the honest answer is that mobile data removes the whole question. The main reason people get burned isn’t technical weakness, it’s impatience: logging into the first network that appears, on a page that isn’t quite the bank’s real one.
A note on free voucher scams
“Connect to our WiFi and fill in your details to win a voucher” pages appear at malls, food courts and events around Cape Town. Some are legitimate marketing. Some are credential harvesting with a prize draw attached. The rule: if a page wants your email, phone number and password to give you free internet, the internet isn’t what’s being sold.
Staff working from hotels, airports and coffee shops?
ARTRIBE Tech sets up secure remote access for businesses, so your team can work from anywhere without the coffee shop being part of your security plan.
Talk to us about remote access →