Usually yes, if you use your bank's official app or type the bank's address yourself and see the HTTPS lock. Bank sites encrypt your login, so another guest can't simply read your password off the network. The real danger is landing on a fake page, not having your encrypted session cracked.
The FTC's current advice is that encryption makes public Wi-Fi usually safe, but scammers can build fake sites that also show a lock. Encryption only protects data on the way; it does nothing if the site at the other end belongs to a crook. That's how hotel and airport attacks tend to work. An Australian man was charged in 2024 for running fake Wi-Fi networks whose sign-in pages captured people's logins.
The more cautious view comes from the NSA, which tells its staff not to access banking on public networks at all. For a normal traveler that's stricter than necessary, but it's a reasonable rule if the network seems off.
Do this before you log in
- Open the bank's app, or type the URL. Never follow a link from a hotel portal, pop-up, or email.
- Stop if the browser shows a certificate warning.
- Turn on two-factor authentication with an app or passkey, not just SMS if you can avoid it abroad.
- Log out when finished.
The hotel network can still see that you connected to your bank's domain, even though it can't see your balance or password. A VPN such as NordVPN hides that too. If you'd rather skip the question entirely, switch to cellular data for the few minutes banking takes.