Is it safe to do online banking on public Wi-Fi?

Yes, in most cases. Your bank’s app and its website encrypt everything between your phone and the bank. A stranger on the same coffee shop network cannot read your balance, your password, or your transfer. The risks that remain are different from the old warnings: a fake network that gets you to type your login on a look-alike page, a phone that is already infected, someone watching your screen, and the few web pages that still load without encryption. Here is what each one means, what the FDIC and FTC say today, and a do-and-don’t list.

What changed since the old advice

The old warning made sense once. The FTC’s public Wi-Fi page says that years ago most websites did not encrypt data, so anyone on the network could snoop. Then it says that has changed: “Today, most websites do use encryption to protect your information,” and “Because of the widespread use of encryption, connecting through a public Wi-Fi network is usually safe.”

Google’s HTTPS by default post from October 2025 puts numbers on it. Encrypted page loads in Chrome went from around 30 to 45 percent in 2015 to the 95 to 99 percent range by 2020. On Android and Mac, more than 99 percent of public-site page loads are now encrypted.

What encryption covers, and what it does not

HTTPS encrypts the content of what you send and receive. The EFF states the limit: “HTTPS protects the content of your communications, but not the metadata.” Someone on the Wi-Fi can see that your phone talked to your bank’s domain, and when. They cannot see the pages, your login, or your transactions.

Banking apps go further. On Android, unencrypted traffic has been blocked for apps by default since Android 9, per Google’s developer documentation. The same page covers certificate pinning, where an app trusts only specific keys, so a fraudulent certificate from an “on-path attacker” is rejected even if a trusted authority issued it. Apple calls it identity pinning. You cannot tell from the outside whether your bank’s app pins, but it will not send your login in the clear.

So where can things go wrong?

A fake network with a fake login page

This is the real threat. The FTC warns that scam sites use encryption too, so “your data may be encrypted on its way to the site, but it won’t be safe from scammers operating the site.” In June 2024, Australian Federal Police charged a man who set up fake free Wi-Fi at airports in Perth, Melbourne and Adelaide and on domestic flights. His networks sent people to a page asking them to sign in with an email or social media login. Encryption cannot help when you type your password into the attacker’s page. See how to tell if a Wi-Fi hotspot is fake.

A phone that is already compromised

If malware is on your device, the network does not matter. The FTC’s phishing guidance says to set your phone to update automatically. CISA adds that file sharing should be off on public networks.

Someone watching your screen

A gate area or hotel lobby has people behind you. The FDIC’s checklist says not to leave a device unattended and to lock it with a passcode. Chase says to log out manually when you are done.

Pages that still load without HTTPS

Google says the remaining few percent of unencrypted page loads is still a meaningful number. On plain HTTP, an attacker on the network can “hijack the navigation and force Chrome users to load arbitrary, attacker-controlled resources.” Your bank’s login page will not be one of these. A third-party site you open in the same session might be. Chrome says that when you see “Not secure” in the address bar, do not enter personal information.

What the FDIC and FTC actually say

The FDIC’s October 2025 guidance says public networks “may not use strong encryption or other security features,” and advises: “If possible, avoid making sensitive transactions, including purchases, on public networks.” It adds that “you may consider using a virtual private network (VPN),” and says to set up multi-factor authentication on every account that allows it.

The FTC says public Wi-Fi is usually safe because of encryption, and focuses on what matters on any network: strong passwords, two-factor authentication, updates, and spotting fake sites. It says to look for the lock or “https” in the address bar, and notes that most mobile apps use encryption even though that is harder to verify.

Banks side with the FDIC. Chase says to “Use a secure, private internet connection when accessing your bank account,” and admits “this might limit where you can log in.”

Read together: using your bank’s app on a network you have verified is low risk. Using a network you cannot verify, or typing your bank password into a page the network put in front of you, is the risk.

When to use mobile data instead

Turn Wi-Fi off and use cellular when:

• You cannot confirm the network name with staff or a sign. CISA says to “Always confirm the name and password of a public Wi-Fi hotspot prior to use.”
• The network asks for a card number or an account password to connect. The AFP’s advice: “you shouldn’t have to enter any personal details” to join free Wi-Fi.
• Your browser shows a certificate warning. Chrome says a full-page “Your connection is not private” error means a problem with the site, the network, or your device. Do not click through it to reach your bank.

A banking session uses almost no data. If your plan is tight, see our plans guide.

What a VPN adds here

Less than the ads suggest, but not nothing. The EFF’s VPN guide says a VPN “can protect any unencrypted internet traffic from surveillance on a public network,” but that this “isn’t as necessary for everyone anymore” because most traffic already uses HTTPS. What a VPN adds is hiding which domains you visit from people on the local network. The trade is that “it’s all visible to the VPN provider,” who “could sell that information, just like an ISP could.”

For banking, the app already protects the content. A VPN covers the stray unencrypted page and hides the fact that you opened your bank. It does nothing against a fake login page you choose to type into. The FTC’s VPN tips say to research the app, check its permissions, confirm it encrypts your traffic, and check whether it shares your data. See which VPNs are worth it and whether free VPNs are safe.

Two-factor and app-based login

This matters more than the network. CISA says that if an attacker steals your password, with MFA on they “will be unable to meet the second authentication requirement,” and that “any MFA is better than no MFA.” It calls FIDO/WebAuthn, the standard behind passkeys, the only widely available phishing-resistant method, because it blocks logins on fake websites. The FDIC adds that MFA “may also alert you of attempts to access your accounts without your permission.”

Chase’s security page describes 2-step verification with a one-time code, passkeys that “let you sign in using your fingerprint, face or device PIN instead of a password,” and an app sign-in that uses your phone’s passcode as a second step. Check your own bank for the same options.

One FTC rule ties it together: “legitimate companies won’t email or text with a link to update your payment information.” If a message or a Wi-Fi login page asks for your bank login, close it and open the app directly.

Do and don’t

Do:

• Use the bank’s app rather than the browser when you can.
• Confirm the network name with staff before joining.
• Turn on two-factor authentication or passkeys at your bank.
• Set transaction alerts so you hear about every deposit, charge, and transfer.
• Keep your phone, browser, and banking app updated.
• Log out when you finish.

Don’t:

• Enter a card number or an account password to get onto Wi-Fi.
• Click past a certificate or “Not secure” warning to reach your bank.
• Bank on a public computer. The FDIC calls library and hotel business center machines risky.
• Leave your phone unlocked on the table.
• Install a free VPN you have not checked.

For venue-specific advice, see airport Wi-Fi, hotel Wi-Fi, and the Wi-Fi safety hub.