For years the warning was that anyone on the same café network could read your traffic. That was true once. It largely is not now, because almost everything you use - your bank, your email, your shopping - is encrypted between your device and the website by default. A stranger on the same network sees that you are talking to your bank, not what you are saying to it.

The first thing that still bites is the fake network. Someone sets up a hotspot called “Costa Free WiFi” or “Hotel Guest”, you join it because the name looks right, and now your connection runs through their kit. They still cannot read the encrypted traffic, but they can push you to a convincing sign-in page and wait for you to type a password. The fix is boring: ask a member of staff for the exact network name, and do not join anything that asks you to “verify” a login you did not start.

The second is the captive sign-in page - the screen that pops up asking for an email to get online. Treat it as untrusted. Give it a throwaway email if you must, never a password you use elsewhere, and never card details. A genuine free network does not need your banking login to let you check the football scores.

The third has nothing to do with the network at all. It is the person sitting behind you reading your screen, or the colleague glancing at the spreadsheet open on the train. If you are a sole trader doing invoices or someone in a regulated firm with client data on screen, that shoulder is the real leak. A privacy filter for the laptop costs a few pounds and does more than any VPN for this particular problem.

If you want a belt-and-braces layer, a reputable VPN does no harm and helps on genuinely dodgy networks abroad. But treat it as a small extra, not the thing standing between you and disaster. The honest picture is that public Wi-Fi is mostly fine, and the failures are about names, sign-in pages and eyeballs, not invisible interception.