That Free Airport WiFi Has a Price, and You're the Product Being Sold

Here's a scene that plays out at every Starbucks, hotel lobby, and airport gate in America: someone connects to "Free_Airport_WiFi," accepts a certificate warning without reading it, checks their bank balance, and moves on with their day.

We treat public WiFi like a public park bench — free, communal, harmless. But unlike a park bench, the network you just joined might not be what it claims to be. And the person sitting two tables over with a laptop and a latte might not be working on their screenplay.

Two Scams That Happen in Real Cafes

The first is called an evil twin. An attacker sets up a hotspot with a convincing name — "Starbucks WiFi," "Delta Free WiFi," "Hotel Guest" — and their laptop becomes the network. When you connect, everything you do routes through their machine. They can see which sites you visit, capture anything you send unencrypted, and serve you fake login pages that look exactly like the real thing. You type your email password into what looks like a Google login, and it's gone.

The second is a man-in-the-middle attack. Here, the attacker joins the same legitimate network you're on and uses freely available tools to position themselves between your laptop and the router. On networks that don't isolate clients — which is most of them — they can snoop on traffic and even force connections to downgrade from secure to insecure.

Neither of these looks dramatic. No hooded figure in a van. It's a person on a laptop who spent twenty minutes on YouTube learning the tools. That's the part people struggle to believe: the barrier to entry is nearly zero.

Why "I Only Browse Safely" Doesn't Cut It

The common rebuttal is that HTTPS — the little padlock in your browser — protects everything now. And it's true that most websites encrypt their traffic. But encryption only protects the content, not everything around it. An attacker on the network can still see which sites you visit, and more importantly, not every app on your phone uses HTTPS as diligently as your browser does. That budgeting app, that smart home app, that old game you forgot you had — some of them are chattier and less careful than you'd hope.

And HTTPS doesn't help at all against an evil twin's fake login page. You'll see a padlock on the attacker's spoofed site too, if they bother to set one up.

The Two-Minute Defense

You don't need to buy anything exotic or live in fear. You need a habit, and it takes about two minutes to build:

One: Get a VPN and actually turn it on. A reputable VPN — Mullvad, Proton, or a paid tier from a major provider — encrypts everything leaving your device, which makes a man-in-the-middle attack mostly useless. Free tiers exist, but be skeptical of free VPNs from companies you've never heard of; you may be swapping one snoop for another. The point is to make it automatic: WiFi connects, VPN connects. Most apps have a setting for exactly this.

Two: Make your phone a hotspot by default. Honestly, this is the move. Your phone's LTE or 5G connection is dramatically harder to intercept than any shared WiFi, and unlimited data plans have made the cost argument mostly obsolete. At the airport, at the coffee shop, at the hotel — unless the WiFi is dramatically faster, just use your own connection. It's the closest thing to a private network you can carry in your pocket.

Three: Develop a padlock habit. Before entering a password or payment info anywhere, glance at the address bar. If the padlock is missing, or the domain looks off — "amaz0n-login.com" — back out. No deal is that urgent.

Four: Forget the network when you leave. Turn off auto-join for public networks so your phone doesn't silently reconnect to an attacker's hotspot next week. On iPhone, Settings > Wi-Fi, tap the network, toggle off Auto-Join. On Android, long-press the network and choose Forget.

The Uncomfortable Part

The reason these attacks work isn't technical sophistication. It's that we've decided convenience beats caution, every single time. Connecting to free WiFi takes five seconds; setting up a VPN and a hotspot habit takes an afternoon, once.

The travelers and remote workers who never get burned aren't paranoid. They just built the habit before they needed it. Two minutes at the airport gate is a cheap insurance premium — and unlike the free WiFi, it actually pays off.