Tips for protecting your identity when browsing public networks

Public Wi-Fi is part of daily life in Australia, from airport lounges and station platforms to café tables, libraries and hotel rooms. People routinely check email, pay bills or shop online after connecting to a free network. That convenience creates a familiar trap: a trusted-looking connection can expose more than a user expects, especially when the device lacks strong security.

A shared access point can make traffic visible to another user or to an attacker operating a convincing look-alike network. Fake hotspots, malicious pages, infected downloads and shoulder-surfing remain practical risks. HTTPS protects most web traffic, yet it does not erase risks from phishing, stolen devices, compromised accounts or careless handling of personal information on a screen others can see.

Rather than treating every free hotspot as dangerous, use a layered routine: prefer cellular data for sensitive work, keep the operating system and apps current, use unique credentials with multifactor authentication, and limit what you do while connected. A personal hotspot or trusted 5G connection is usually a better choice than open venue Wi-Fi for banking, health services or work systems.

Australian users can choose from robust mobile networks operated by Telstra, Optus and Vodafone, including prepaid data and phone hotspots. Free Wi-Fi is widely offered at Sydney and Melbourne airports, major railway stations and neighbourhood cafés, although service quality and terms vary. Official guidance from the Australian Cyber Security Centre and eSafety offers a better security baseline than guessing which network name is genuine.

Understand what shared networks can reveal

Not every public connection is compromised, and modern browsers make casual browsing safer than many people realise. The website address can reveal which service a person uses, while device and account identifiers may be transmitted as part of ordinary requests. Attackers may also record traffic patterns, exploit weak router settings or persuade a user to join a fraudulent access point with a familiar name.

An attacker with control over a hotspot may redirect a request, inspect unencrypted traffic or capture information entered on a look-alike page. Strong encryption reduces the value of intercepted data, but it cannot protect credentials typed into a fake website. Automatic updates, a reputable password manager and an alert for unexpected sign-in prompts add further layers.

This matters on Australian journeys where coverage changes quickly. A commuter moving from a metropolitan NSW or Queensland train into a tunnel may see the phone fall back from Wi-Fi to mobile data or lose coverage entirely. Public Wi-Fi at airports may also be shared with thousands of travellers. Treat a sudden network-name change, certificate warning or login request as a reason to stop and reconnect through mobile data.

Strengthen your device and accounts first

Start with the device in your pocket. Turn on automatic operating-system and browser updates, use a strong screen lock, encrypt the device where available, and review which apps may access personal data. Reinstalling an unknown app or connecting a found USB drive can undermine an otherwise careful setup. Removing unused browser extensions and disabling unnecessary location permissions further reduces the information available to a malicious page.

Accounts tied to Australian services deserve extra care because a single recovered mailbox can expose my.gov.au, My Health Records, online banking and other connected profiles. Use a different generated password for every account, store them in a password manager and enable multifactor authentication or passkeys. Keep recovery email addresses and mobile numbers current, and never approve a sign-in prompt you did not initiate.

Phishing remains effective even when a connection is encrypted. Avoid shortened links in unexpected texts, check the spelling of Australian bank, government and retailer domains, and reach sensitive sites by typing the address or using a trusted bookmark. If an Australian account has already been exposed, contact the provider promptly; rapid password changes and session revocation are more valuable than simply deleting the suspicious message.

Choose a safer route onto the internet

Ask whether the task truly needs an open network. Reading a public timetable or checking a non-sensitive update may involve little risk; transferring money, accessing health information or entering work credentials deserves a private connection. Use your phone’s 5G or 4G data when the mobile signal is dependable, and consider a personal hotspot for extended work sessions in places such as an airport gate lounge.

Connecting to a hotspot named “Airport Free Wi-Fi” is not proof that it is legitimate. Compare the name and any instructions displayed by venue staff, disable automatic joining for unknown networks and forget the network when you leave. A reputable virtual private network can add protection on managed networks, although it does not make a phishing site, infected download or stolen password harmless.

Readers seeking an accessible general-information starting point can review general site information, then confirm technical steps against guidance from the Australian Signals Directorate. Its advice on automatic updates, phishing and multifactor authentication is more useful for protecting an identity than relying on a venue’s claim that its network is “secure”.

Keep high-risk browsing under control

Even low-stakes leisure browsing deserves basic caution. A page offering gaming compatibility checks should be treated like any unfamiliar service: check the full domain, avoid public USB charging, and do not add payment or identity details until the final site loads over HTTPS with the expected address. Private browsing on a borrowed device also does not remove traces stored by the operating system or other apps.

• Use mobile data or a personal hotspot for banking, health, payroll and employer systems.
• Confirm the domain letter by letter before entering a password, one-time code or payment detail.
• Lock your screen whenever you step away, and keep bags and phones out of sight.
• Download apps and files only from official app stores or verified developer sites.
• Sign out of sensitive accounts and clear session data when using a shared or borrowed device.

Clear browser data only when needed, since it can remove useful offline records. More importantly, pause the session if a website asks for a password, payment method or identity document over an unfamiliar hotspot. Save the task for a trusted connection, verify the request independently, and avoid scanning identity documents into web forms in a busy café.

Make safer browsing your default

Australian institutions can help when an identity is at risk. The Australian Cyber Security Centre provides practical self-assessment and incident guidance, the ACCC’s Scamwatch explains common scams, and IDCARE supports people dealing with identity theft. Keep a note of which accounts and devices were exposed, because that record helps providers, banks and support services contain the damage.

If credentials may have been entered on a fake network, disconnect, change the affected password from a trusted device, revoke active sessions and notify the relevant provider or bank. Report suspicious messages to Scamwatch and seek specialist identity-theft support when documents or financial accounts are involved. Do not continue testing suspicious links from the same device; preserve screenshots and details for official reporting.

Before the next airport flight, train trip or café visit, decide which connection suits the task, update your phone, review account recovery options and bookmark the sites you need. Choose mobile data for anything sensitive, stay alert when the network changes, and leave public browsing when privacy cannot be assured. Small, repeatable decisions protect an Australian digital identity far better than relying on one perfect hotspot.