Public Wi-Fi safety for staff: hotels, airports and cafes

Tolu lands in a new city and opens her laptop at the airport. There are four networks. Two have almost the same name. One has no password, and one asks her to “sign in with your company email to get free Wi-Fi.”

She picks the last one and types her work password. It is a fake page. By the time she reaches the gate, someone else is signed in as her.

You do not need to fear every cafe. You need a few habits, and the first one is easy.

What is the safest way to get online?

Use your own phone hotspot. Turn it on, connect your laptop, and you are on a network only you control.

If you cannot, here is the order I would pick:

1. Your phone hotspot.
2. The venue’s network, with the exact name and password from a member of staff.
3. An open network with no password and no staff to ask. Only for things that do not matter, like reading a news page.

Our guide to what staff should know about phone safety covers the phone side, including updates and a screen lock.

How do fake networks work?

A fake network is easy to set up. Someone gives their own Wi-Fi a name that looks right, like “Skyline Hotel Free” next to the real “Skyline_Hotel_Guest.” People who connect to the wrong one send their traffic through a stranger’s gear.

Some fake networks lead to a sign-in page that looks real. It asks for an email and password “to continue.” That is the trick. The page is not there to give you Wi-Fi. It is there to collect your login.

What is the 10-second check?

What about captive portals?

A captive portal is the page that pops up when you join a hotel or airport network. It might ask you to accept terms, enter a room number, or give an email.

That is normal. These are not normal:

• It asks for your work password or your company email and password together.
• It asks for a card number for “free” Wi-Fi.
• It asks you to install something to continue.
• The web address looks odd, or the page has no padlock and looks half-finished.

If you see any of those, close the page, forget the network and switch to your hotspot. Our guide on spotting the fake email tricks shows how to read an address, and it works for these pages too.

What does a VPN do, and what does it not do?

A VPN (virtual private network) makes a private tunnel from your device to a server. People on the same Wi-Fi cannot read what goes through it.

That helps. But a VPN does not:

• Tell you the sign-in page is fake. If you type your password into a scam, the VPN carries it there safely.
• Stop malware you download.
• Stop a scam call or text.
• Make an untrusted VPN trustworthy. A free VPN app you found yourself may be worse than no VPN.

So: use the VPN your office gives you, if there is one. Do not install a random one to “be safe.” Ask IT.

For general good habits, the UK’s NCSC keeps a short page of top tips for staying secure online. CISA’s page on securing wireless networks is a good read for the people who run the office Wi-Fi.

What about the US and Nigeria?

In the United States, airports, hotels and coffee shops are the usual places. Your phone hotspot uses your plan’s data, so check your plan before a long video call.

In Nigeria, many people rely on a mobile data plan or a router at work, a cafe or a co-working space. A phone hotspot is just as useful there. If a shared router has a default password written on the side, tell whoever runs it. That password is public.

What if you already did it?

Do not worry about being embarrassed. Act in this order.

1. Disconnect. Forget the network and switch to your hotspot.
2. Typed a work password? Change it now on the real site, from a safe network. Tell IT.
3. Typed a card number? Call your bank on the number on your card, ask them to block it and dispute any charge.
4. Used the same password anywhere else? Change those too.
5. Check your sign-ins. In your email and work apps, look at recent activity for places or devices you do not know.
6. Report it. Our steps for what to do after clicking a phishing link fit here too. In the US, you can also report to ReportFraud.ftc.gov or IC3.gov.

Keep reading

Related guides: work phone safety habits, why to stop sharing work logins, and what to do at the front desk with guest Wi-Fi. A fake sign-in page also shows up in the sign-in prompt you did not ask for.

Try it safely

Practice helps more than reading. Our free phishing test sends your team safe, made-up phishing emails and shows who clicked and what to fix. See also how phishing simulation training works.

For managers and owners: staff on the road need a clear rule, a way to get online safely and a person to call. AkolagTech has a plain guide on working on public Wi-Fi on the go, and a post on guest Wi-Fi versus business Wi-Fi for the office itself.