I was listening to a podcast the other day which was sponsored by a VPN provider. During the talking points for the advertisement, the host said something to the effect of the following (I'm recalling this from memory, but this is the gist)

Have you ever had your credit card hacked? Be wary of using public WiFi networks when purchasing something, the networks are full of hackers attempting to steal your information. In fact, the number one way that credit card details are stolen is through hackers downloading them via coffee shop wifi. With VPN Provider you can count on a safe experience...

And then goes on to tout the benefits of a VPN. However, this claim doesn't sit right with me. Are more details stolen through public WiFi interception than, say, data breaches from major retailers? Or is this a case of "coverage bias" where large breaches get more news coverage (and therefore more recognition)?

  • 6
    No, it's not even close. Most credit cards are stolen from hacked PoS systems. The way it's written right there is that the hackers are downloading CC numbers (which were stolen from PoS systems) over coffee shop wifi, which is probably slightly less absurd.
    – user
    Nov 1, 2019 at 17:42
  • @user Oooh, true. I totally forgot about that angle! Skimming probably has a much larger impact
    – Jeeter
    Nov 1, 2019 at 17:43
  • especially today where browsers are starting to warn you if data is being sent over HTTP instead of HTTPS.
    – ewanm89
    Nov 1, 2019 at 19:28
  • 7
    The marketing campaigns of VPN providers are FUD-fueled borderline scams, full of half-truths, all ending with an implied "therefore use our product". It's not that VPNs in general are a bad thing. It's just that they solve a specific problem that the general population just does not have. It's as if guitar pedal manufacturers tried to tell everybody that they need a clean boost pedal, regardless if they play guitar or not.
    – user163495
    Nov 1, 2019 at 20:38
  • 1
    @Jeeter The average user usually doesn't have to worry that much about breaches. Regularly checking their CC bill for any unknowns is the safest bet.
    – user163495
    Nov 4, 2019 at 9:13

1 Answer 1


Most likely not.

"Public Wi-Fi" has an incredibly bad reputation, back from when it first became popular to have publicly accessible Wi-Fi. Back in the late 00's, it became a more and more common sight for coffee shops and other establishments to offer free Wi-Fi for guests. This coincided well with the rise of the iPhone and the subsequent smartphone boom.

The problem was, that back then, "Secure by Default" was not really a thing. We worried more about getting stuff to work than to get it to work securely. Many websites just offered plain HTTP, with HTTPS being considered "just for banking" or other such things.

Mixing plaintext protocols with open Wi-Fi is not a good idea, and many tools from that time are designed just for the purpose of listening to HTTP traffic around them and scraping login-data and session tokens out of the air. But even back then, credit card data was mostly transmitted via HTTPS.

What about now?

The internet today looks different from the internet back then. The rise of Let's Encrypt made it possible for everyone to get a HTTPS certificate without any monetary investment, making it possible for even the smallest deployments to be HTTPS secured. We also got rid of a lot of anti-patterns, such as offering different content based on whether the request was HTTP or HTTPS, which in turn allowed the widespread deployment of HSTS, a HTTP header designed to get users to use HTTPS whenever possible.

As a result, public Wi-Fi has become a lot less dangerous than it used to be. Even if one were to enter their Credit Card data in a form while connected to a public Wi-Fi, the chances of it being stolen are relatively small - assuming that they follow common security advice (e.g. don't click TLS errors away, make sure you use HTTPS, etc.).

In regards to data breaches, I don't have any concrete data as to how many credit cards are leaked via breaches versus stolen through public Wi-Fi. However, storing Credit Card data is really difficult, because you can't just hash it like a password. It needs to be available in reversible form, and that's not easy to do. As a result, just from a pure gut-feeling, I would say it's more likely to have your credit card stolen from a data breach than through public Wi-Fi.

What about VPNs? Would they help?

Not really. All that a VPN does is to connect you to a VPN endpoint and send your request from there. Sure, the connection to the VPN endpoint may be encrypted, but that really doesn't change anything in the overall situation. If your traffic was plaintext to begin with, you now exchanged "Hoping that nobody in this Coffee Shop will steal my data" with "Hoping nobody in that Data Center will steal my data", which only marginally sounds better.

The reason why they advertise VPNs as the silver bullet to security is simple: Common folks don't know a lot about security. They've heard about IT security, about encryption, about hackers, etc. but they really don't have any deeper understanding. That's not a jab at laypeople - I don't know anything about how a car works, about UX design or how to cool pizza that tastes good - it's just the reality of things.

The problem is that VPN providers use scare tactics like this to get consumers to buy their product, under the false pretense that it'll make their life better. A regular consumer has no way of verifying that claim. They can use a VPN religiously and can't really know if it helped them at all or not. Even more tech-savvy users have no way of knowing that, because I highly doubt any VPN provider would allow customers to check out their data center, get a feel for the company culture or conduct a penetration test of their infrastructure. All in all, the vast majority of Average Joe's out there don't need a VPN.

  • 1
    Indeed. I have somehow developed an unfortunate habit of having my credit card details regularly stolen (happens every 1-2 years, almost without fail). I never use public wifi. Of course I also never figure out the source of the breach. However, I can guess. I stopped using my credit card at gas pumps after I learned that gas skimmers happened in my area. I also have frequented stores that (now) have known breaches (Moe's, Target, etc...). Nov 4, 2019 at 14:34
  • 1
    @ConorMancone Sadly, stores will often only do the absolute minimum they legally have to when handling credit card details. They're more concerned that customers can pay quickly, rather than to keep their data secure.
    – user163495
    Nov 4, 2019 at 14:35
  • 1
    Although most (larger) companies these days don't actually store credit card numbers themselves, but send them directly off to PCI compliant processors for storage. I have yet to read about a leak from one of those companies (not yet anyway), so I suspect that most online credit card theft happens through "web based card skimmers" (although I think that's a terrible name for it). Nov 4, 2019 at 14:36
  • Ain't that the truth - security is just never on the top of the list. Nov 4, 2019 at 14:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .