Set your devices up before you travel, then keep a short routine every time you connect. Most of the protection comes from settings, not from vigilance in the moment.
Before the trip
- Update everything. Patch your phone, laptop and browser before you leave so you aren't fixing things on hotel Wi-Fi, where fake update prompts are a known trick.
- Turn on two-factor authentication for email, banking and cloud accounts. The FTC points to strong passwords and 2FA as the main defense, since most sites already encrypt traffic.
- Turn off auto-join. The NSA recommends disabling auto-connect and turning off file and printer sharing on laptops used on public networks.
- Install a VPN and test it at home. A VPN such as NordVPN encrypts everything between your device and the VPN server, so the hotspot operator or anyone spoofing it sees only scrambled traffic.
Each time you connect
- Join the network staff name, finish the captive portal login, then switch the VPN on.
- Stick to sites and apps that load over HTTPS with no certificate warnings.
- Type addresses for your bank or email yourself instead of following links from the portal page.
- When you leave, forget the network so your device doesn't rejoin a copycat later.
A VPN won't stop you from typing a password into a phishing page or downloading malware, so the habits above still matter. For anything high stakes, like a large transfer, your phone's cellular data is the safer pipe.