Airport and Hotel Wi-Fi: The Real Risks, and Why Mobile Data Is Safer
Public Wi-Fi is not as dangerous as it was ten years ago, but the remaining risks are specific and worth knowing. Here is what can actually go wrong, and why your own mobile data sidesteps most of it.
The "public Wi-Fi will steal your bank details" warning is dated. Almost all web traffic is encrypted now, and the classic coffee-shop eavesdropping attack mostly stopped working when HTTPS became universal.
But "less dangerous than it was" is not "safe", and the remaining problems are worth understanding — particularly because the alternative, your own mobile data, avoids nearly all of them for free.
What is genuinely still a risk
Evil twin networks. Anyone can broadcast a Wi-Fi network called "Airport_Free_WiFi". Your phone cannot tell the difference between that and the real one. Whoever runs it sees which sites you visit (even over HTTPS, the domain is visible), can serve you fake login pages, and can redirect you.
Captive portals that ask for too much. Some hotel and airport portals want an email, a phone number, or a social login. That is data collection, and occasionally worse — a "log in with your account" prompt on a network you do not control is a phishing pattern.
Networks that never expire on your phone. Your device remembers "Hotel_WiFi" and will auto-join anything with that name, anywhere in the world, forever.
Unpatched devices on shared networks. Hotel networks often put all guests on one flat network segment. An unpatched laptop is more exposed there than at home.
Certificate warnings people click through. Under time pressure at a gate, travellers accept warnings they would refuse at home. That is when the encryption argument stops protecting you.
Why mobile data is structurally safer
Cellular traffic is encrypted between your device and the network by design, and you are connected to a licensed operator's infrastructure rather than an unknown box under a desk. There is no evil twin equivalent for a cellular network that a casual attacker can set up.
With a travel eSIM, you also avoid the captive portals entirely — no email harvesting, no "sign in with" prompts, no terms you did not read.
It is not that cellular is unbreakable. It is that the practical attacks against public Wi-Fi do not have easy equivalents against it.
Practical rules for travellers
Use your own data for anything that matters. Banking, work email, anything involving a password. A few megabytes of mobile data is cheaper than the alternative.
Turn off auto-join for public networks. iPhone: Settings → Wi-Fi → tap the network → Auto-Join off. Android: forget the network after use.
Turn off "Ask to Join Networks" prompts so you are not tempted at a gate.
Verify the network name with staff if you do use hotel or airport Wi-Fi. It takes one question.
Never accept a certificate warning on a public network. Ever.
Keep a VPN for work. If your employer provides one, use it on any network you did not set up. It also solves the "which network is this" problem.
Do the heavy things on Wi-Fi, the sensitive things on mobile. Downloads and backups over hotel Wi-Fi; banking and logins over your own data. That is the split that balances cost against risk.
The non-security reason to prefer mobile data
Public Wi-Fi is also just worse. Airport Wi-Fi is congested and time-limited; hotel Wi-Fi is frequently capped per device and slow in the evening. A travel eSIM is consistent, available on the street and in a taxi, and does not require reconnecting every time you move.
FAQ
Is hotel Wi-Fi safe for Netflix? Yes. Streaming is fine. It is logins and financial apps that deserve your own connection.
Does a VPN make public Wi-Fi safe? It substantially reduces the risk, provided you trust the VPN provider. It does not protect against a fake captive portal you type credentials into.
Is 4G safer than 5G? Both are encrypted. This is not a distinction worth worrying about as a traveller.
Should I use airport Wi-Fi to install my eSIM? You can, but it is far better to install at home before you fly — see when to install your travel eSIM.
What about public charging ports? A separate risk. Use your own charger and cable, or a data-blocking adapter.
The bottom line
Public Wi-Fi is mostly fine for mostly harmless things, and genuinely risky for logins on a network you cannot verify. Your own mobile data removes the ambiguity for the price of a few megabytes — which is a very cheap way to stop having to think about it. Set the phone up correctly before you fly (dual SIM abroad) and pick a plan from the destination list.
