Yes, a bank's official app from the App Store or Google Play is generally safe on public Wi-Fi, and often safer than logging in through a browser. The app connects only to the bank's own servers over encrypted connections, so you can't mistype a URL or click into a look-alike site.
Banks also tend to add extra checks. Many apps use certificate pinning, which means the app refuses to talk to any server that can't present the bank's specific certificate. That blocks most attempts by someone on the same network to sit in the middle of your connection.
That said, apps aren't flawless. In 2017, University of Birmingham researchers found that apps from banks including HSBC and Bank of America pinned certificates but skipped hostname checks, leaving them open to interception on hostile networks. The banks patched the issues, but it shows why keeping apps updated matters.
Keep the app side tight
- Download only from the official app store, using the link on your bank's website if unsure.
- Install updates promptly, along with OS updates, as the FTC advises.
- Use Face ID, fingerprint, or a passkey, and turn on transaction alerts.
- Never enter bank details into a Wi-Fi sign-in page.
The FTC also points out that most mobile apps encrypt traffic, though it's hard for you to confirm which ones do. That uncertainty is the main argument for a VPN. With one such as NordVPN running, everything from the phone is encrypted before it reaches the public network, including the less careful apps you have installed. It won't protect you from a fake banking app or a phishing text, though.