Avoid handing over credentials or installing anything through the Wi-Fi login page, and hold off on high-value transactions until you're on cellular data or a VPN. Here's the specific list.
- Downloads the network asks for. No legitimate hotspot needs you to install a browser update, "network fix" tool, certificate or PDF viewer. In a campaign Microsoft disclosed in July 2026, attackers on hotel and conference Wi-Fi showed fake update prompts that installed a remote access trojan and an infostealer.
- Logging in through portal links. If the portal sends you to a Microsoft or Google sign-in page, close it and go to the site directly.
- Your real email on sign-up forms. A throwaway alias works fine for most portals and keeps you off marketing and phishing lists.
- Sites that throw certificate warnings. Clicking through "your connection is not private" on a public network is exactly how interception succeeds.
- Plain HTTP pages for anything sensitive. The FTC notes that encryption is what keeps login details safe in transit; without it, they can be exposed.
- Leaving sharing on. Set Windows to a public network profile, which hides your PC and blocks file sharing. On iPhone, keep AirDrop on Contacts Only.
- Banking or big purchases without protection. The FCC suggests switching to mobile data when sending private information. A VPN is the alternative if you have no signal.
- Auto-joining. Don't let your phone reconnect to "Airport_Free_WiFi" on its own next time. Forget the network when you leave.