Public Wi-Fi risk is still being underestimated by users

At a glance

What this is: This article argues that public Wi-Fi is commonly underestimated because users trust convenience more than the actual exposure created by open networks, fake hotspots, and interception risks.

Why it matters: It matters because identity, banking, and corporate sessions can be exposed on networks that many people treat as harmless, so IAM and security teams need controls that assume untrusted connectivity.

By the numbers:

• 31% of American travelers use public Wi-Fi while traveling within the U.S, according to Jscrambler.
• 24.7% of public hotspots worldwide do not use any form of encryption, according to Jscrambler.
• 67% of reported incidents took place on planes, according to Jscrambler.
• 12% of incidents were traced to employees using unsafe networks while traveling, according to Jscrambler.

Context

Public Wi-Fi is an access problem as much as a convenience problem. Open networks create a trust gap because users cannot easily verify who else is on the network, whether traffic is encrypted, or whether the access point is genuine. That makes public connectivity a useful case study in how identity, session trust, and transport security fail together.

For IAM and identity security teams, the relevance is straightforward: a login session established over an untrusted network is only as safe as the controls around authentication, transport protection, and user behaviour. For corporate access, the issue is not whether public Wi-Fi exists, but whether the organisation assumes employees will use it and designs for that reality.

Key questions

Q: What breaks when employees use public Wi-Fi for sensitive work?

A: The main failure is that the connection itself becomes an untrusted entry point for credential theft, session interception, and spoofed network attacks. If users can reach corporate or financial systems over public Wi-Fi without added protection, the organisation has effectively delegated network trust decisions to the individual user, which is too inconsistent for security governance.

Q: Why do open networks increase the risk of credential capture?

A: Open networks make it easier for attackers nearby to observe traffic, impersonate access points, or intercept users before they reach the intended service. When encryption is missing or users land on malicious hotspots, credentials can be captured during login or reused against email, banking, or enterprise accounts.

Q: What are the signs that public Wi-Fi use is putting credentials and data at risk?

A: Warning signs include unknown or similarly named access points, automatic connection behavior, untrusted captive portals, and any request to enter credentials on a network you did not verify. Public Wi-Fi also becomes risky when users handle sensitive data, change passwords, or click unfamiliar links. The safer pattern is to avoid sensitive actions on open networks and use a trusted mobile connection or VPN where appropriate.

Q: Should organisations allow corporate access from public Wi-Fi at all?

A: Yes, but only with clear boundaries. Organisations should decide which systems can be used over untrusted networks, require strong authentication and encrypted transport, and prohibit the highest-risk actions such as administrative access, financial transactions, or sensitive data handling unless the user is on a trusted connection.

Technical breakdown

Why open Wi-Fi exposes identity and session trust

An open Wi-Fi network removes the first layer of confidentiality between a device and the access point. If the network is unencrypted, nearby attackers can capture traffic or observe metadata, and if the user reaches an HTTP site, contents can be exposed in clear text. Even when the application uses HTTPS, the network still creates risk through session hijacking attempts, rogue access points, and credential harvesting. The weakness is not just the network itself, but the false assumption that physical proximity to a cafe, airport, or hotel implies digital trust. That assumption fails quickly when authentication and transport controls are left to the user alone.

Practical implication: treat public networks as hostile and require encrypted transport plus strong authentication for any sensitive access.

How evil twin hotspots and MITM attacks work

A fake hotspot, often called an evil twin, copies the name or appearance of a legitimate access point to lure users into connecting. Once the device joins, an attacker can place themselves between the user and the destination service, intercepting, redirecting, or altering traffic. Man-in-the-middle attacks are easier when users auto-connect to familiar SSIDs or accept convenience over verification. This is not a theoretical wireless issue only; it is a trust and identity issue because the device is authenticating a name, not the legitimacy of the provider behind it. The control failure is human and technical together.

Practical implication: disable auto-join on untrusted networks and verify the access point before any credential entry or sensitive session.

Why VPNs reduce exposure but do not remove the risk

A VPN creates an encrypted tunnel over an untrusted network, which reduces exposure to local interception and passive monitoring. That helps protect traffic in transit, but it does not make the underlying network trustworthy, nor does it fix phishing, malicious portals, compromised endpoints, or insecure applications. If the user connects to a fake hotspot and then authenticates to a spoofed service, the VPN does not solve the identity problem. In practice, VPNs are a compensating control, not a substitute for secure service design, user verification, or avoiding high-risk transactions on shared networks.

Practical implication: use VPNs as one layer only, and keep banking, corporate admin access, and sensitive work off public networks where possible.

Threat narrative

Attacker objective: The attacker wants to capture credentials, sensitive personal data, or corporate access from users who believe the network is safe enough to trust.

1. Entry begins when a user connects to an open public hotspot or a rogue twin network that mimics a legitimate venue SSID.
2. Credential_harvested follows when the attacker intercepts logins, reads unencrypted traffic, or captures information entered into spoofed pages and sessions.
3. Escalation occurs when the stolen data is used to access email, banking, or corporate accounts, or to deliver malware to the device.
4. Impact is theft of personal or business data, account compromise, and in some cases device infection or wider corporate exposure.

Breaches seen in the wild

• New York Times GitHub breach 2024: An exposed GitHub token gave an attacker The New York Times' repositories; the 270GB leak held 4,875 unique secrets.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Public Wi-Fi is a trust boundary failure, not just a user mistake: the network invites identity and session risk because the user cannot reliably verify the access point, the transport path, or the surrounding threat environment. That means the security model has to assume the connection itself is untrusted. Practitioners should treat this as a transport and access governance problem, not a simple awareness issue.

Open networks turn convenience into a credential collection surface: once auto-connect, fake SSIDs, and unencrypted traffic combine, the environment becomes optimized for harvesting passwords, session tokens, and business data. The named concept here is the public access trust gap, where users overestimate venue legitimacy and underestimate interception risk. Security programmes should design for that gap explicitly, because user judgement alone is not a durable control.

VPNs are a compensating control, not a governance model: encryption in transit reduces exposure, but it does not validate the network, the hotspot operator, or the destination service. That distinction matters for IAM teams because authentication controls still depend on where and how users connect. The practical conclusion is that policy, identity, and transport controls have to work together, not in isolation.

Corporate exposure on public Wi-Fi is an access policy issue as much as a mobility issue: employees will continue to connect in transit, so organisations need rules that reflect actual behaviour rather than ideal usage. The relevant governance question is which transactions are permitted on untrusted networks and which are not. Programmes that leave that boundary undefined are relying on users to make risk decisions in real time, which is not a control.

What this signals

Public access trust gap: the bigger problem is not Wi-Fi availability but the collapse of user confidence in the boundary between a legitimate venue network and a rogue one. Organisations should assume that employees will connect in transit and should define which identity-sensitive actions are unacceptable on shared networks.

The practical programme response is to shift policy from generic awareness to explicit trust boundaries. That means combining device settings, authentication controls, and user guidance so a login session is never the only thing standing between an attacker and corporate access.

For practitioners

• Define untrusted-network access policy Classify public Wi-Fi as hostile by default and specify which activities are prohibited, restricted, or allowed only with additional controls.
• Enforce secure session requirements Require HTTPS, modern authentication, and MFA for remote access, and block legacy or plaintext protocols from sensitive services.
• Disable automatic network joining Remove auto-connect behaviour on endpoints so users must explicitly approve each network before the device joins.
• Train users to verify hotspot identity Teach staff to confirm the official SSID with venue staff and to avoid logging into business systems on unknown networks.
• Route high-risk tasks to private connectivity Direct banking, admin access, and confidential work to mobile data, a private hotspot, or another trusted connection instead of shared Wi-Fi.

Key takeaways

• Public Wi-Fi creates a trust problem because users cannot reliably verify the network, the operator, or the path their data takes.
• The article’s evidence shows that public hotspots, especially in travel settings, remain a common environment for interception and fake access point abuse.
• The strongest defence is not avoidance alone but clearer policy boundaries, stronger session protection, and a refusal to perform sensitive tasks on untrusted networks.

Key terms

• Public Access Trust Gap: The mismatch between a user’s sense that a familiar venue network is safe and the reality that the connection may be hostile, spoofed, or monitored. In practice, it is a governance problem because the organisation cannot rely on user intuition to determine when sensitive access is acceptable.
• Evil Twin Attack: A wireless attack in which an attacker creates a fake access point that mimics a legitimate network name and appearance. Users connect believing it is safe, allowing the attacker to intercept traffic or capture credentials. It is a common deception technique in environments where users rely on familiar Wi-Fi names.
• Man-in-the-Middle Attack: A man-in-the-middle attack is an interception technique where an attacker positions themselves between two parties that believe they are communicating directly. The attacker can read, alter, or replay traffic, which makes the attack especially dangerous when credentials, sessions, or certificates are involved.
• Compensating Control: A compensating control is a measure that reduces risk when the ideal fix, such as immediate patching or redesign, is not possible. In OT, compensating controls often include session recording, access restriction, and tighter monitoring. They do not eliminate the underlying issue, but they narrow exposure until safer remediation can happen.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is designed for practitioners who need to connect identity controls to real operational decisions across access, privilege, and lifecycle management.