Your phone holds the keys to your bank, your email and your social accounts. Two of the easiest ways criminals get into them are unsafe Wi-Fi networks and “SIM swapping,” where someone steals your phone number itself. Neither requires hacking skills, which is exactly why they are so common. Here is what you need to know and the simple steps that shut both doors.
Is public Wi-Fi exposing my banking details?
Public Wi-Fi at airports, hotels and coffee shops is safer than it used to be, because most banking apps and websites now encrypt your connection with HTTPS. Still, open networks carry real risks: fake hotspots with names like “Airport_Free_WiFi” set up by scammers, poorly secured routers, and devices on the same network that can see some of your traffic. You do not need to panic, but you should be careful with anything financial.
Safe habits on public Wi-Fi
– Use cellular data for banking. Your phone’s mobile connection is much harder to intercept than a shared hotspot. When in doubt, switch Wi-Fi off before opening your bank app. – Use a reputable VPN on public networks. A VPN encrypts everything between your device and the VPN server, so people on the same Wi-Fi cannot see it. Choose a well-known paid provider; free VPNs often sell data or are slow. – Verify the network name with staff before joining, and avoid networks that ask you to install anything or enter personal details. – Look for HTTPS and the padlock in your browser, and turn on “HTTPS-only” mode in your browser settings so it warns you before loading an unencrypted page. – Turn off auto-join for open networks so your phone does not silently connect to a look-alike hotspot. – Keep your phone updated. Security updates patch the weaknesses attackers rely on.
Do not forget your home network
Your home router matters as much as public Wi-Fi. Change the default admin password, use WPA2 or WPA3 encryption with a strong Wi-Fi password, turn on automatic firmware updates, and put smart TVs, cameras and other gadgets on a separate guest network so a weak device cannot be used to reach your laptop or phone.
How do I prevent SIM swapping and account takeovers?
In a SIM swap, a criminal convinces your mobile carrier, often with personal details found online or in data leaks, to move your phone number to a SIM card they control. Your phone suddenly loses service, and every text message, including the one-time login codes your bank sends, goes to them. From there they reset passwords and drain accounts, sometimes within an hour.
Lock down your carrier account
– Set a carrier PIN or passcode and ask your carrier to require it for any SIM change or number transfer. Most major carriers also offer a free “number lock” or “port-out protection” feature; turn it on in your account settings or ask customer service. – Use a strong, unique password for your carrier’s website and app, and turn on two-step verification there too.
Stop relying on text-message codes
– Switch to an authenticator app (such as Google Authenticator, Microsoft Authenticator or Authy) for email, banking, social media and crypto accounts. Codes are generated on your phone, not sent by text, so a SIM swap cannot catch them. – Use passkeys or a hardware security key such as a YubiKey for your most important accounts. They are the strongest protection available against account takeovers. – Remove your phone number as a recovery option where an app or authenticator is available instead.
Keep your number and details private
Do not post your phone number, birthday or address publicly, and be careful with quizzes and “verify your account” messages. Scammers collect small details to impersonate you.
Warning signs
If your phone suddenly shows “No Service” or “SOS only” in an area where it normally works, and you get emails about password changes you did not make, act immediately: call your carrier from another phone, then change your email and bank passwords and contact your bank.
The bottom line
Use mobile data or a VPN for anything financial on public Wi-Fi, secure your home router, lock your carrier account with a PIN, and move your important accounts from text-message codes to an authenticator app or security key. Those few steps block the vast majority of these attacks.