The four main risks are evil twin hotspots, malicious captive portals, exposure of unencrypted traffic and browsing metadata, and open file sharing on your own device.
1. Evil twin hotspots
An attacker sets up a network with a convincing name, like the airline or airport's own. You connect, and they control what you see. In 2024 the Australian Federal Police charged a man who allegedly ran fake Wi-Fi networks on flights and in airports, sending passengers to a fake login page that collected email and social media credentials.
2. Hijacked or fake login pages
Captive portals load before most protections are in place. In mid-2026 Microsoft warned that a state-linked group was manipulating hotel and conference Wi-Fi portals to push fake Microsoft sign-ins and bogus software updates carrying malware.
3. Unencrypted traffic and visible metadata
HTTPS protects the content of most sites, but not everything. Older apps, smart devices and plain HTTP pages can still send data in the clear. Even with HTTPS, the EFF explains that anyone along the path can usually see the domains you visit, when, and how much data moves. A VPN hides that from the hotspot, shifting the visibility to the VPN provider instead.
4. File sharing and open services
A laptop marked as a trusted home network may advertise shared folders and printers to everyone in the lounge. AirDrop or Bluetooth left discoverable invites unsolicited files and pairing requests. Set your laptop to a public profile, keep AirDrop on Contacts Only, and turn Bluetooth off when you don't need it.
Notice what isn't on the list: a stranger casually reading your HTTPS banking session. That threat has largely faded.