Free airport, hotel and restaurant Wi-Fi may be convenient, but security experts are warning travellers not to treat it as automatically safe, with compromised networks potentially exposing passwords, payment details and other personal information.
The issue was brought into focus by Microsoft’s disclosure of a hacking campaign called CaptiveCrunch, which targeted networks using the captive portals commonly found in hotels and other hospitality venues.
Microsoft said it had observed malicious actors manipulating internet traffic from affected networks since early May 2026, redirecting users through attacker-controlled infrastructure. Some attacks led travellers to fake Microsoft pages designed to steal login credentials or delivered malware disguised as a software update.
The findings do not mean every hotel or public Wi-Fi network is compromised, but they show why even a network that appears familiar should be approached cautiously.
The warning comes as business travel continues to grow. The Global Business Travel Association forecasts 1.84 billion business trips globally in 2026, around 25 million more than in 2025, while spending is expected to rise 7.2 per cent to US$1.71 trillion.
Vodafone senior customer security, fraud and scam governance manager Amelia Limbrick said travellers could become less cautious about their digital security once a trip was underway.
“Travelling overseas often means letting our guard down, but that’s exactly when scammers are looking to strike. Hotel and public WiFi networks are a common target because people assume they’re safe to use for everything from checking emails to online banking. But these networks can be easily compromised, giving criminals a direct line to your personal and financial information.
▼ ADVERTISING ▼
“Our advice is simple: treat public WiFi the same way you’d treat a stranger asking for your password – with caution. A few small habits, like using your own mobile data instead of hotel WiFi, and updating your passwords before you leave, can make a real difference in keeping your information safe while you’re away.”
Five digital safety tips
1. Stop shoulder snoopers
A privacy screen for a phone or laptop can make it harder for someone nearby to view passwords, banking apps, booking details or work information. Travellers should also avoid opening sensitive accounts where a screen can be easily seen, particularly on public transport and in airport lounges.
2. Choose mobile data over public Wi-Fi
Where possible, travellers should use their own mobile data or personal hotspot after checking their roaming plan and destination coverage. If public Wi-Fi is unavoidable, confirm the correct network name with venue staff, turn off automatic connection settings and avoid online banking or other sensitive activity.
Travellers should also be wary of any unexpected prompt to download a software update after connecting. Disconnect from the network and install legitimate updates through the device’s settings using a trusted connection instead.
Security experts are warning that everyday phone use while travelling can expose passwords, payment details and other personal information.
3. Bring a charger or power bank
Travellers should carry their own wall charger, cable or power bank rather than relying on public USB charging ports. The Australian Cyber Security Centre advises that public charging stations and ports could put data at risk if they have been compromised.
4. Secure important accounts before departure
Review key email, banking and social media accounts before leaving, replace any weak or reused passwords and enable multi-factor authentication. Real-time banking alerts can provide an early warning of unexpected transactions, while a backup payment method gives travellers another option if their primary card or account is blocked or compromised.
Travellers relying on SMS authentication should also check that they can receive messages overseas. The Australian Cyber Security Centre recommends using an authenticator app or another stronger form of multi-factor authentication where possible.
5. Save the real-time holiday updates
Posting flight details, hotel check-ins and a precise location can reveal more than travellers intend. Limiting real-time posts and sharing the holiday photo dump after returning home can reduce both digital and physical security risks.
KARRYON UNPACKS: This is a simple pre-departure value-add for travel advisors, particularly when clients will be working abroad or relying on airport and hotel connectivity. Adding a short digital safety checklist to final documents can help clients protect their accounts and payment details while reinforcing the advisor’s role beyond the booking.