Online banking on public Wi-Fi: VPN or not?

A banking app on public Wi-Fi is already encrypted end to end by the app itself, so a VPN does not make the session more secure than it is. What a VPN adds is privacy from the network: without one, the café, hotel or airport can see that your phone connected to your bank, when, and for how long. Whether to use one comes down to that, plus one complication: some banks treat a login from a VPN server's address as unusual and ask for extra verification, which is why an exclude list that keeps the banking app outside the tunnel is often the tidiest answer.

What the bank already protects

Banking apps are among the most carefully built pieces of software on a phone. The connection to the bank uses TLS, the same encryption as HTTPS, and most banking apps go further with certificate pinning: the app accepts only the bank's own certificate, so a network that tried to sit in the middle with a forged one would be refused outright. Your password, your balance and every transaction are encrypted before they leave the phone.

That was not always true, and most of the warnings about banking on public Wi-Fi come from an era when it was not. Today the session itself is not the weak point.

What the network still sees

Even with that encryption, a network you do not control sees the outside of the connection.

The first two rows are the privacy argument for a VPN. They are metadata, not money, and on a hotel network the risk is mostly a log entry rather than a theft. The public Wi-Fi risks post sets out who can see that log.

The last row is the complication.

Why some banks dislike VPN logins

Banks score every login for risk, and one of the strongest signals is the address it comes from. A login from an address the bank has never seen, in a city you have never been in, from a range it knows belongs to a VPN provider, scores high. The bank's response varies: some ask for a one-time code, some ask you to confirm on another channel, some refuse the login and lock the app until you call.

None of this is the VPN doing anything wrong. It is the bank correctly noticing that the address changed. But it means that connecting to a server on another continent and then opening your bank is a reliable way to trigger extra checks, and occasionally a lockout at an inconvenient moment.

Three ways to handle it

Exclude the banking app from the VPN. Android lets a VPN app keep chosen apps outside the tunnel. The banking app then talks to the bank directly over the local network, protected by its own TLS and pinning, from the address the bank expects, while everything else on the phone stays inside the VPN. This is the option most people should pick. The split tunnelling post explains how the exclude list works, and the apps to exclude post has the wider list.

Connect to a server in your own country. If your bank is in the Netherlands and the VPN exits in Amsterdam, the login looks local and most banks are content. This keeps the banking traffic private from the local network at the cost of the bank seeing a shared address, which some banks flag anyway.

Use mobile data for banking. The carrier link is encrypted to your phone individually, there is no sign-in page to worry about, and the bank sees a mobile address it has probably seen before. For a two-minute transfer this is the simplest option, and the hotspot comparison post covers the trade-offs.

The risk a VPN does not cover

The realistic danger on public Wi-Fi is not someone decrypting your banking session. It is a fake sign-in page, served by the network before you have connected anything, that looks like your bank and asks for your login. A VPN cannot connect until the network's own page has been accepted, so it is not involved at that moment.

A banking app's pinned certificate protects you here too: it will refuse a fake bank server. The exposure is a browser and a convincing page. Use the app rather than the website on a network you do not trust, and never enter a bank login on a page the Wi-Fi presented to you.

A short decision

1. If you have mobile data, use it for banking and skip the question.
2. If you are on public Wi-Fi with a VPN, exclude the banking app from the tunnel, so the bank sees the address it expects and the rest of the phone stays private.
3. If you would rather the bank not see the local network's address either, pick a VPN server in your own country and expect an occasional extra verification step.
4. Use the app, not the browser, and refuse any sign-in page that asks for banking details.

Culvert VPN's split tunnelling is an exclude list, so a banking app placed on it stays outside the tunnel on every network while apps installed later are protected by default, on Google Play.