Do You Need a VPN for Public WiFi to Trade?

Originally published on BaroqTech.

Partner links are marked as affiliate links. We may earn a commission if you use one. How we review.

A VPN for public WiFi is the right extra step when the network is not yours: a cafe, a hotel, an airport, a train, a conference hall, or any hotspot whose name you did not choose. It encrypts the path from your laptop to a VPN server, so the shared network does not get a clear copy of the broker page. It does not make the trade safe, it does not hide the order from the broker, and it does not replace the password and the second factor on the account. If the network is your own, at home, a personal VPN is optional. If you are about to type a platform password on someone else's Wi-Fi, turn the tunnel on first, or use your phone's mobile data instead.

Key takeaway

• On a network you do not control, use your phone's mobile connection when you can. If you stay on the shared Wi-Fi, turn a VPN on before you open the platform.
• A VPN hides the broker site from the cafe. It does not hide the order from the broker, and it does not hide your screen from the person at the next table.
• Turn on the platform's own second factor while you are still on a network you trust. A tunnel does not do that job.

Do you need a VPN for public WiFi?

The short answer is yes when three things are true at once. The network belongs to someone else. You are about to open an account that can move money or place an order. And you cannot, or will not, switch to mobile data. In that case a VPN for public WiFi is one of the controls official guidance already names, next to checking the network name, staying on an encrypted website, and logging out when you are done.

The short answer is no in two other cases, and both matter.

The first is the network you control. A home router with a password you set, software you update, and no stranger sharing the air with a reason to watch you, is a different problem from a hotel lobby. The Federal Trade Commission's February 2011 consumer alert, "Wise Up about Wi-Fi," says you can treat a hotspot as secure only when you are asked for a WPA password, and that a browser page which merely grants access should be treated as unsecured. A home network that asks for WPA is the case that alert is pointing at. WPA2 is the strongest option that 2011 alert names. It does not discuss WPA3, because WPA3 was not the consumer advice on that page. Do not read the alert as a 2026 product review. Read it as the FTC's own line on when a wireless network is encrypting what you send, and when it is not.

The second case is the one where you should not be logged in at all. CISA's "Cybersecurity While Traveling" tip card says not to conduct sensitive activities, including banking and sensitive work, on a public wireless network, and says your own mobile connection is generally more secure. A brokerage login is sensitive work. The cleanest reading of that card is: do the login on mobile data, or do not do it until you are back on a network you know. A VPN is the fallback for the trip where mobile data is not available, not a reason to sit in a lobby and manage a large position because the tunnel icon is green.

There is a third limit, and it is the one people skip because a VPN advert sounds absolute. CISA's "Federal Mobile Workplace Security" publication of August 2024, in the section on public space, says vulnerabilities still exist even when a government device is using a VPN. It names masquerading, exploits over radio interfaces, and network sniffing. It also says not to expect any privacy in a public setting, and it says VPNs are attractive targets because they can open a path into a private network. That publication is written for federal workplaces and government-furnished equipment, not for a retail gold account. The network facts in it still apply to a laptop in a cafe: a tunnel reduces one exposure and leaves others standing. A green icon is not a statement that nothing can go wrong.

So the decision is a sequence, not a slogan.

1. Can you wait until you are on a network you control? Wait.
2. If you cannot wait, can you tether to your phone's mobile data? Do that, and still confirm the laptop is using a tunnel if the work is a login. The phone's connection and the laptop's connection are not the same pipe. The NCSC's device guidance, reviewed 13 May 2025, notes that tethered traffic is not always carried inside the phone's VPN. Put the VPN on the machine that is logging in.
3. If you are staying on the venue's Wi-Fi, confirm the name with staff, connect, accept only the venue's own access page, then bring the tunnel up before any platform page loads.
4. Then, and only then, open the broker by typing the address yourself.

None of those steps picks a direction in gold. None of them changes the spread, the swap, or the size of a loss. Position size is a separate job. If you are sizing a trade while you travel, do it with the position size calculator and the guide on how much to risk on a trade, on a session you have already decided. The VPN question is about who can see the login. The size question is about how much you can lose. Keep them apart.

What can a public Wi-Fi network see?

A public network is a shared wire made of radio. Everyone who has joined it is on the same local network, and the equipment that runs it sits between you and the rest of the internet. That equipment, and anyone in a position to impersonate it, is the thing you are deciding to trust when you tap "join."

Start with what joining actually does. Your laptop asks for an address. The router hands one out. From that moment the router can see that your device is there, how much data it moves, and, unless something else is encrypting the traffic, where each connection is going. The FTC's February 2011 alert says most hotspots do not encrypt the information you send, and that on an unsecured network a login to an unencrypted site can be seen by other users on that network. The alert says those users could hijack the session and log in as you, and that a copied username and password can then be tried on other sites. The alert is fifteen years old. The part that has not expired is the distinction it draws, which is still the right one to hold in your head.

An encrypted website protects the information you send to and from that site. The alert says to look for https at the start of the address and a lock icon, for the whole visit, not only on the sign-in page. If any part of the session drops back to an unencrypted page, the alert says the whole account could be vulnerable, and it says to log out at once. Clicking the lock is how you read who the browser thinks it is talking to. That check is free, and it is the check a lot of people do once and then forget while they click around a platform.

A VPN, in the same alert's words, encrypts traffic between your computer and the internet, even on an unsecured network. The alert tells people who regularly open accounts on hotspots to use one, either a personal VPN account or a VPN their organisation provides. That is the FTC's recommendation, dated February 2011, and it is the sentence this article is built on. It is not a claim that every VPN product is equal, and it is not a claim about a price.

What the website's own encryption does not do is make you invisible to the network. The cafe can still see that your laptop is associated with its router. It can still see that you are sending data. With an ordinary encrypted site, the network can usually still see which server you connected to, because that address is how the packets are delivered. The password, the order ticket, and the page contents are what the site's encryption is there to hide. Do not tell yourself the cafe "sees nothing" because the address bar says https. Tell yourself the cafe should not be able to read the password, and then still refuse to do the login on a network you have not checked.

There is a second thing the network can see before any page loads: the name you asked for. If your laptop looks up the broker's name through the cafe's equipment, that lookup says where you are about to go. A VPN is supposed to carry those lookups inside the tunnel as well. The NCSC's guidance for organisations, on the VPN page reviewed 13 May 2025, says only traffic which is routed over the VPN is protected by it. If the app sends some traffic outside, that traffic is back on the cafe network. This is why "the icon says connected" is not the whole test. The test is whether the trading program's traffic is actually inside the tunnel. Split routing, which that page calls split tunnelling, is the setting that leaves some traffic outside on purpose. For a broker login, you do not want the login left outside.

Captive portals sit in front of all of this. A captive portal is the page a hotel or cafe shows before it lets you onto the internet: a button for the terms, a room number, a code from the till. The NCSC page says the device has to open that page directly, before the VPN is up, because the portal is on the local network. Until you have passed it, there is no tunnel. That page is allowed to be the venue's page. It is not allowed to be your broker's page. If a "Wi-Fi login" asks for an email password, a platform password, or a card number beyond what the venue needs to grant access, close it. The FTC alert says a hotspot that asks for a password through the browser, simply to grant access, should be treated as unsecured. A room-number form at a hotel is that kind of page.

Fake names are the other half of joining. CISA's travel tip card says to confirm the network name and the exact login steps with staff, so that the network is the legitimate one, before you connect at an airport, hotel, station, or cafe. The card does not give a count of how often a lookalike name is used. It gives the action: ask a person who works there. A printed card on the counter can be wrong if someone else printed it. The person at the bar is the check. Then forget the network when you leave. The same card says to stop auto-connecting, including Bluetooth, so the laptop does not join a network you did not pick this time.

Shared computers are a different product from shared Wi-Fi, and a VPN does not fix them. The travel card warns that hotel business-centre machines, library computers, and cyber-cafe computers may be out of date, and that a keylogger on such a machine can record what you type and send it on. If the keyboard is recording the password, the tunnel only encrypts the already-stolen password on its way out. Use your own device. If the only machine in the room is not yours, do not log in to a broker on it.

The screen is the last thing on this list, and it is the one a network diagram leaves out. The August 2024 CISA publication says not to expect privacy in public, to be aware of cameras and of people recording, and it lists a screen privacy filter so that data is readable only from directly in front of the display. It also says not to leave a session unlocked when you step away. A VPN does not frost the glass. If you must work in a room, sit so that the screen faces you and a wall, lock the machine when you stand up, and do not leave it to hold a table.

What does a VPN change, and what does it leave open?

A consumer VPN is a tunnel from your device to a server the VPN company runs. Your laptop encrypts the traffic, sends it to that server, and the server sends it onward to the broker. On the cafe side, the visible connection is the one to the VPN server. On the broker side, the visible connection is the one from the VPN server. Those are two different observers. Collapsing them into "nobody can see me" is how this subject gets oversold.

This is the split, in plain rows.

Read the middle row twice. The VPN company is now in the seat the cafe used to occupy, for the traffic inside the tunnel. A careful company writes down what it does not store. A careless one is a new copy of the problem, with a logo. This article does not repeat a logging claim from a provider page it did not open on 10 November 2026. The action is yours: open the provider's policy, read the sentence about connection logs, and do it before the password goes in. If the sentence is missing, do not invent it.

The NCSC page is explicit that its VPN guidance is for organisations choosing and running VPNs for their own staff, and that individuals typically use VPNs for different reasons, so they are not the audience of that page. Use it for the engineering, not as a consumer ranking. The engineering that transfers is this.

Only routed traffic is protected. A forced tunnel, in their terms, sends user traffic through the VPN and blocks connections that try to go around it. If the tunnel cannot connect, the device has no network until you turn that force off. That is inconvenient at the captive portal, and it is the behaviour you want a minute later, when the broker page is the thing you care about. An optional tunnel can be left off, or can drop, while the laptop quietly sends the login over the cafe network. The NCSC says that gap is a risk to the data. A consumer app often labels the forced behaviour as a kill switch. The label is not the proof. The help page for the app you installed is the proof, and the default in that app is whatever that page says. This article does not state a default it did not read.

Automatic is different from forced. The NCSC separates them. Automatic means the device brings the tunnel up when software asks for the network. Forced means traffic is not allowed to leave any other way. You can have a tunnel that starts by itself and can still be switched off. You can have a tunnel that, once on, blocks everything else, but that you must start by hand. For a login on hostile Wi-Fi, you want both: it comes up without a reminder, and it does not leak while you think it is up. Manual start is how people open the platform first and connect second. CISA's August 2024 public-space list says to activate the VPN session immediately after connecting to a third-party network. Immediately means before the bookmark, not after the platform has already loaded.

Full-device is different from per-app. A per-app tunnel protects only the programs on a list. The NCSC says that increases the risk that something you forgot, or a system component, sends data outside. A trading setup is rarely one program. The desktop platform, the browser chart, the mail client that receives the withdrawal code, and the time sync can all speak. If only the platform is inside the tunnel and the mail client is outside, the code that approves a withdrawal took the cafe path. Prefer the mode that covers the whole device for the hour you are logged in. Put it back to a lighter mode later if you have a reason. Do not discover the gap during the login.

Split tunnelling is the route version of the same gap. Some destinations go through the tunnel, the rest go direct. The NCSC says this increases the chance that sensitive data meets an unprotected network, and that it can also let an outside party reach back through the device. A charting site you "left outside so it would be faster" is still a login if that site is where your broker connects. Leave split routing off for the session.

Third-party clients, as against the VPN built into the operating system, are what a consumer subscription usually is. The NCSC says a third-party client raises the chance that integration is poor and that some data leaves the tunnel, and it adds another package you have to update. That is not a reason to skip a personal VPN on a cafe network. The FTC alert tells hotspot users to get a personal VPN account from a provider. It is a reason to keep the app updated, and a reason not to assume the operating system is routing every packet just because the app window says "protected."

CISA's August 2024 list for public Wi-Fi and hotspots, again written for federal users, is short enough to copy into a trading habit without copying the parts that are about agency badges. Update devices over a trusted network, not over the cafe. Use a VPN or another authorised secure-access method. Activate it immediately after you join the third-party network. Use a firewall and malware protection. Encrypt the device. Do not do the software update itself on the lobby network. An update is a large download from a place your machine will trust. Let that happen at home, before the trip, which is also what the travel tip card says: update before you go.

What the tunnel does not change is the list below. Read it as the boundary of the product, not as a reason to skip the product.

• The broker still receives the order and still applies its own rules.
• The screen is still readable by a person or a camera behind you.
• A stolen, unlocked laptop is still logged in until the session ends.
• A password saved in the browser is still on the machine.
• A fake site still receives whatever you type into it.
• A shared computer that records keystrokes still records them.
• The VPN server, and the company that runs it, can see what the tunnel carries, to the extent their system is built to see it.
• If the tunnel drops and the app does not block other traffic, the next click can go out over the cafe again.

CISA's public-space section says the residual items out loud: masquerading, radio-interface exploits, and sniffing remain even with a VPN on a government device. A personal laptop is not that device, and it does not get a free pass those lines withhold from a managed one.

Is your phone's hotspot safer than cafe Wi-Fi?

CISA's travel tip card says your own mobile network connection, which it also calls your wireless hotspot, is generally more secure than a public wireless network, and it says to use that feature if your plan includes it. That is the cleanest official line in the pages opened for this article. The mobile network is still a network someone else runs, the carrier, but it is not a lobby full of strangers on the same local segment, and it is not a name anyone in the room can imitate with a pocket router.

Use it in this order.

If the phone is the device you trade on, turn off Wi-Fi and use mobile data. Confirm the platform app is the one you installed from the official store, not a file a stranger sent. Then the login is on the carrier path. You can still add a VPN on the phone. You do not have to, for the narrow purpose of getting off the cafe's local network. You might want to, if you do not want the carrier to see which platform you opened. That is a privacy preference. It is not the same problem as the stranger at the next table.

If the laptop is the device you trade on, tether it. A USB tether is harder to join by mistake than a Wi-Fi hotspot with a guessable name. If you do use the phone as a Wi-Fi hotspot, set a long password and do not use the venue's name as the hotspot name. CISA's card says to disable auto-join so you connect only when you mean to. A laptop that auto-joins "Hotel Wi-Fi" while your phone is also offering a hotspot will pick whichever it remembers. Forget the venue networks.

The NCSC note on tethering is the detail that makes this less simple than "phone equals safe." A full-device VPN on the phone does not, on every platform, pull tethered devices inside that same tunnel. Some phones send the laptop's traffic around the phone's VPN. Some will not tether at all while the phone's VPN is up. If the login happens on the laptop, the VPN that matters is the one on the laptop. Check the laptop, not the phone's status icon.

Mobile data fails in the places traders actually sit: basements, thick hotels, foreign SIMs with no roaming, plans that bill hard for a tether. When it fails, you are back to the venue network, and the earlier sequence applies. Do not "just this once" type the password because the chart was about to move. The chart will still be there after you have a tunnel, or it will not, and chasing it on an open network is how a login gets copied for a move you were late for anyway. Session times are on gold trading hours. Knowing when the market is actually active is a reason to be finished and logged out, not a reason to hurry the password.

Data caps are a practical limit, not a security property. A tether that dies mid-session drops the tunnel with it. If the laptop then falls back to the cafe Wi-Fi automatically, you are on the shared network with the platform still open. Turn off auto-join before you start, so a dead tether fails closed. Lock the screen while you sort the connection out. The August 2024 CISA list says not to leave the session unlocked when you step away. A spinner on a chart is you stepping away.

How should you log in on a shared network?

The path and the login are different locks. The path is the VPN, mobile data, and https. The login is the password, the second factor, and the list of devices the platform already trusts. Do the second factor at home, days before the trip. A setup screen that shows a QR code is a bad thing to flash in a food court, and a text message that arrives late on roaming is a bad thing to depend on while a position is open.

Three official help pages, opened on 10 November 2026, show how three widely used platforms actually do the second factor. They are examples, not a complete list of brokers. Your platform's own page wins if it disagrees.

MetaTrader 5

MetaTrader 5's help page on one-time passwords says two-factor authentication, using a time-based one-time password, is an extra level of security that still protects the account if the login and the password leak. When it is enabled, the platform asks for that extra password on every connection, on top of the account login and the master password, and on top of a certificate if extended authentication is also on. The help page says each one-time password is valid for 30 seconds, then a new one is generated.

The broker's server has to allow it. The page says this can be optional or mandatory, depending on the regulatory or market requirements that apply to that server. Do not assume the desktop platform will offer the switch. Connect in the ordinary way, then look for "Enable 2FA/TOTP" in the account menu in Navigator. The page says you then scan a QR code in an authenticator app and enter the code the app shows. It names the mobile MetaTrader platforms on iPhone and Android, and it names Google Authenticator, Microsoft Authenticator, LastPass Authenticator, and Authy, from the App Store or Google Play.

On the phone apps, the first opening of the one-time-password section asks you to set a four-digit password on the generator itself. You bind an account with the server name, the account number, and the master password. The page says you can bind an unlimited number of accounts. It also says an account can be linked to only one generator. To move to a new phone you disable the old binding first, which requires a code from the old generator. If the phone is lost, the page says to contact the broker to reset the binding. Do that reset from a channel you already know, not from a link in a surprise email.

One exception is easy to miss. The page says a one-time password is not requested when you connect with the investor password, which is the view-only mode. View-only mode is not "no access." It is access to the account's positions and history. Treat the investor password with the same care as the master password. Do not leave it in a chat, a screenshot, or a note on the laptop.

The phone generator has a command to synchronise the device clock, because the code is valid only for the current time interval and the platform and the server have to agree what time it is. If a code is rejected, check the clock before you assume the account is broken. Set the phone to automatic time on a network you trust, not by guessing a timezone in the lobby.

TradingView

TradingView's help page "How to configure 2FA" says two-factor authentication means that after the password you also enter a one-time code. It offers two ways to get that code: an authenticator app, or SMS to the phone number on the account. The page recommends the app, and it says text messages are less reliable, may not arrive in some countries, and can be delayed. That delay is exactly the failure you do not want on roaming Wi-Fi.

The page says backup codes are generated when you turn the feature on, and that those codes are the only way back in if you lose the password or cannot use the second-factor device. It says to write the codes down and keep them somewhere safe, not to rely on copy-and-paste, and not to store them on your devices. It also says TradingView cannot recover the account if you lose the codes, and that you accept that when you enable the feature. Read that sentence before you turn it on. A backup code in a photos folder on the same laptop is not a backup. It is a second copy of the key on the thing a thief would take.

Setup lives under Privacy and Security, then Account Settings. The page says an account that signs in only through a social login has to set a password first. You scan a QR code with Google Authenticator, Microsoft Authenticator, Duo Mobile, or Authy. If the code is rejected, the page says to check that the devices show the correct time. Changing phones means signing in with a backup code or with a device that still has a live session, turning the feature off, and turning it on again on the new phone. Do that rotation at home.

The same help page is about the TradingView account. A broker connected through that account may have its own second factor as well. Turn on both. One of them does not satisfy the other.

Interactive Brokers

Interactive Brokers' campus lesson "IB Key – Two-Factor Authentication – Android," read on 10 November 2026, describes IB Key inside the IBKR Mobile app as a second factor for logging in to the trading account. The lesson says you register from the app's login screen. One path uses a session id or a QR code from a platform you are already signed in to, such as Client Portal, and then a PIN. Another path uses the account username and password, confirms the mobile number on the account, and enters an activation code that arrives by SMS. The lesson says the PIN is 4 to 6 digits. After activation, the lesson says IB Key can be used for Client Portal, Trader Workstation, and the IB Debit Mastercard.

The login the lesson describes is: username and password first, then a prompt to open the notification on the phone, then Approve, then a biometric, a security PIN, or a pattern. There is also a QR path: the computer shows a code, the phone scans it, you approve. A reply on that same lesson page, from the Interactive Brokers campus account, says clients can use SMS as an authentication method, alongside IB Key and, for eligible clients, a Digital Security Card+, and it says SMS cannot be turned back on once a permanent security device has replaced it. That is a comment on the lesson, not the lesson's own steps. If you use SMS, know that the lesson's preferred picture is the approve-on-phone step, and know the limitation that reply states before you switch away from SMS and want it back.

What this means on public Wi-Fi: the password alone should not be enough. The phone is the second factor, so the phone needs its own lock, and the approval prompt needs to be read. Approve means you are looking at a login you just started. An approval prompt you did not start is a prompt to deny. The VPN does not make that prompt honest. You do.

What these three pages do not say

They do not say every broker has the same switch. MetaTrader's page is explicit that the server may or may not offer one-time passwords. If yours does not, ask the broker in a channel you already use, and until then do not log in from a lobby. They do not say a second factor stops a withdrawal you yourself confirm, or a login you approve on a prompt you did not read. They do not say the feature can be set up safely for the first time on a network you do not trust. Set it up before you travel. Write the backup codes on paper. Leave the paper at home if the risk you are managing is a stolen bag, or carry it separate from the laptop if the risk you are managing is a lost phone. Those are different losses. Pick the one you are actually exposed to this week.

While you are in the account settings, end sessions you do not recognise, and turn off "remember this device" on any machine that stays in a hotel room. CISA's travel card says a few minutes is enough time for someone to steal what is on an unlocked device. A remembered browser is an unlocked device that does not look unlocked.

Does a VPN stop a fake broker page?

No. The tunnel's job is to carry bytes to the address you asked for. If you asked for a lookalike, the tunnel delivers you there, encrypted, and the lookalike receives the password. Encryption is not a spell-check on the name in the address bar.

The FTC alert says some sites encrypt only the sign-in page, and that you should watch https and the lock for the entire visit. It says browsers warn on some fraudulent sites and on some malicious downloads, and that you should pay attention to those warnings and keep the browser updated. It also says not to stay permanently signed in, and not to reuse a password across sites, because a password copied from one account gets tried on the others. A trading password that is also your email password is two accounts for the price of one mistake.

CISA's travel card says to think before you click, to delete suspicious mail, and to be careful with unknown links and with apps you did not review. The August 2024 publication says to watch for people asking unusual questions, which it puts under social engineering. A person in a cafe who "works for the platform" and needs your code is that situation. A platform employee does not need the one-time code. The code is how you prove you are you. Handing it over proves you are helpful, and it proves nothing else.

The practical habits, all of them compatible with a VPN and none of them done by the VPN:

• Type the platform address, or use a bookmark you created at home. Do not use the link in the email that arrived while you were on the venue network.
• Read the host name before you type the password. A stray letter is the whole attack.
• If the page asks for the one-time code and also asks you to "confirm" by approving a prompt you did not expect, stop. Close the page. Open the real app yourself.
• Do not install a "support" program because a chat window on a website told you to. CISA's card says to review an application before you install it.
• If you already typed the password into a page you now distrust, change the password from a network you control, end the other sessions, and assume the one-time codes that were on that page are burned.

A VPN company can offer an extra block-list of known bad sites. If the app you use has that switch, read what it claims and turn it on if you want it. It is an extra list, maintained by someone else, and it will be incomplete the day a new lookalike appears. It does not replace reading the address.

Can a VPN address cause a problem with a broker?

It can, and this article will not pretend to have read a ban it did not open.

A platform sees the address of the machine that connected. With the tunnel up, that address is the VPN server's address, which is often in a different country from the chair you are sitting on. Platforms that are allowed to serve some countries and not others use addresses as one of their signals. If you appear to be in a country they do not serve, the login can fail, or an order can be refused, or the account can be restricted. Using a tunnel in order to look as if you live somewhere you do not, so that you can trade where you are not allowed to, is a terms problem. This article is not a way around a restriction. It is a way to keep a login from being read on a cafe network in a country you are allowed to trade from.

Because broker pages were not the source set for this article, there is no quotation here of a named broker's VPN rule. Open the terms on the broker's own site, and open the security page, before you depend on an exit address. If the terms are silent, silence is not permission. If a withdrawal suddenly asks for extra checks because the address changed, that is the platform doing the job you wanted the second factor to do. Let it. Do not "fix" it by turning the VPN off and retrying the withdrawal on the hotel network.

The broker still sees the trade. A VPN does not anonymise an account you have identified with your own documents. It changes the network address on the session. Support staff who ask why the address changed should get a plain answer: you were on a public network and you used a VPN. Do not invent a location.

There is a related habit that causes more lockouts than the country question. People turn the VPN on and off between the password step and the one-time-code step, or the phone is on mobile data while the laptop is on the tunnel, and the platform sees two addresses for one login. Stay on one path until you are in. If the code then fails, check the clock, as the MetaTrader and TradingView pages both say, before you start switching servers.

None of this is a forecast about whether a trade makes or loses money. The address check can stop you placing an order. It cannot make the order a good one. The research record and the calculators are separate from this network question. Live prices and the calendar are on Markets. How partner links on this blog are marked is on How we review.

Which settings matter before you connect?

Set these on a network you trust, then leave them alone. The lobby is a bad place to learn the menus.

The tunnel comes up by itself, and other traffic stops if it drops. That is the NCSC pair: automatic, and forced. In a consumer app, look for a switch that blocks the internet when the VPN disconnects. Read the provider's help text for whether that switch starts in the on position. If the help text says you must enable it, enable it at home and watch a test: turn the tunnel off and see whether a browser can still load a page. If it can, the switch is not doing the job. CISA's August 2024 line is to activate the session immediately after you join the third-party network. A switch that blocks leaks is what makes "immediately" survivable when the tunnel hiccups.

The whole device is inside, for the trading hour. Turn off split routing and per-app exceptions for that session, for the reason the NCSC gives: leftover traffic is unprotected traffic. If a particular app breaks because it cannot see the local network, fix that at home, or do not use that app while you are on the venue Wi-Fi. Do not poke holes you will forget to close.

The captive portal is allowed to be ugly, and it is not allowed to ask for the broker password. Join the Wi-Fi, let the system open the venue page, accept the terms or enter the room code, and only then let the forced tunnel take over. The NCSC prefers the operating system's captive-portal helper to the habit of switching the forced tunnel off and browsing in the main window. iOS and macOS have that helper, the page says, and other systems may need one. If you must turn the force off to reach the portal, turn it back on before you touch a bookmark. Do not leave it off "for the afternoon."

Auto-join is off, Bluetooth is off unless you need it, and the venue network is forgotten when you leave. That is the travel card. A laptop that remembers every hotel will join the next lookalike without asking. Forgetting the network is a ten-second step at the door.

The device is updated, encrypted, and locked. Updates happen at home, which both CISA documents say in their own words. A disk that is encrypted is still yours if the bag is stolen, provided the machine was shut down or locked. A disk that is not encrypted is a copy of the platform session for whoever has the laptop. The travel card says to back up before you go, and to keep the device with you, including in the taxi and the hotel room. Meal times, the card notes, are when unattended laptops go missing from rooms.

The second factor is already on, and the backup codes are not in the same bag as the only copy of anything. Covered above. Check it the day before, not the minute before.

You know how you will pay for the VPN, and you have read the logging sentence. A subscription you start on the cafe network, by typing a card into a page you have never seen, is a second sensitive login. Open the account at home. Confirm the app is the one from the provider's own site or the official store.

If you want a commercial provider and you use the link in the next paragraph, that link is an affiliate link. We may earn a commission if you sign up. It does not add a fee on your bill, and it does not change the engineering above. The disclosure at the top of this page is the same statement for every partner link on the blog.

NordVPN (affiliate link) is the only partner link in this article. No price is quoted, because no pricing page was used as a source on 10 November 2026. Whatever you pick, the checks are the same: the logging sentence, whether the app can block traffic when the tunnel drops, whether you can cover the whole device, and the renewal terms on the provider's site the day you pay.

A free app is not "the same checks, skipped." Read how it is paid for. If you cannot find a logging sentence, do not put a broker password behind it.

What is the checklist before you trade on public Wi-Fi?

Do these in order. The order is the point. A tunnel you start after the platform has loaded has already missed the login.

1. Decide whether the order can wait until you are on a network you control. If it can, wait.
2. If it cannot, try your phone's mobile data or a tether first. CISA's travel card calls that connection generally more secure than public Wi-Fi.
3. If you stay on the venue network, ask staff for the exact name and the exact access steps. Connect only to that name.
4. Forget other venue networks on the laptop, and turn off auto-join and Bluetooth unless you need a specific device.
5. Pass the captive portal. Stop if it asks for a platform password, an email password, or a payment card the venue does not need.
6. Turn the VPN on immediately, and confirm that a dropped tunnel blocks other traffic. Then open the platform by a bookmark or a typed address.
7. Check https and the lock for the whole visit. If the lock disappears, log out, as the FTC alert says.
8. Use the second factor you already turned on at home. Deny any approval you did not just start. Do not read a code aloud to anyone.
9. Place only the order you planned. Size it before you travel, with a loss you can carry. The position size calculator is the tool for that job. The VPN will not do it.
10. Log out. Lock the screen. Forget the network. Do not leave the laptop to hold the table.

A single afternoon, written as a sequence rather than as a scare story, looks like this. You are in a hotel on 10 November 2026, which is the day the source pages for this article were opened. The lobby Wi-Fi has a name close to the hotel's brand. You ask the desk, and you join the name they speak, not the name that was already remembered on the laptop. A browser tab opens by itself and asks you to accept terms. You accept the terms. You do not type anything else into that tab. You start the VPN and you watch the status say the tunnel is up. You turn the radio off for a moment and you confirm the browser cannot load a page while the tunnel is down, then you turn the radio back and let the tunnel return. You type the platform address. The lock stays. The password goes in. The phone asks you to approve a sign-in you just started, and you approve it with the phone's own lock. You check the position you already sized. You do not open a second idea because the lobby is comfortable. You log out, you lock the laptop, and you forget the network in the wireless list before you go upstairs. That sequence uses no number this article did not read. It is the checklist, once, in order.

What this article does not claim

It does not claim a VPN makes you safe in every sense. CISA's August 2024 publication says residual attacks remain even with a VPN, and it says not to expect privacy in public. Those sentences are the limit.

It does not claim a speed, a server count, a jurisdiction, or a price for any VPN. Those figures were not taken from a provider page on the day this was written.

It does not claim a broker bans or allows VPNs. Read the broker's terms.

It does not claim the February 2011 FTC alert is a current catalogue of Wi-Fi products. WPA2 is the strongest option that alert names. Treat its encryption distinction as the part you are using, and treat its product examples, including old browser add-ons, as dated.

It does not tell you to place a trade. A network control is not a view on gold.

Sources read on 10 November 2026

These are the pages this article relies on. If a line here and a line on the page disagree, the page wins, and this article should be updated.

• Federal Trade Commission, consumer alert "Wise Up about Wi-Fi: Tips for Using Public Wireless Networks," February 2011: https://www.govinfo.gov/content/pkg/GOVPUB-FT-PURL-gpo18584/pdf/GOVPUB-FT-PURL-gpo18584.pdf
• CISA, "Cybersecurity While Traveling" tip card, Stop.Think.Connect: https://www.cisa.gov/sites/default/files/publications/Cybersecurity%20While%20Traveling.pdf
• CISA, "Federal Mobile Workplace Security," publication dated August 2024, public-space section: https://www.cisa.gov/sites/default/files/2024-08/Federal-Mobile-Workplace-Security_508_2024-08-14.pdf
• NCSC, "Virtual Private Networks," device security guidance, published 29 June 2021, reviewed 13 May 2025, version 2.1. Written for organisations, not as a consumer buying guide: https://www.ncsc.gov.uk/collection/device-security-guidance/infrastructure/virtual-private-networks
• MetaTrader 5 help, "2FA/TOTP — Authentication Using One Time Password": https://www.metatrader5.com/en/terminal/help/start_advanced/otp
• TradingView help, "How to configure 2FA": https://www.tradingview.com/support/solutions/43000572460-how-to-configure-2fa/
• Interactive Brokers campus lesson, "IB Key – Two-Factor Authentication – Android": https://www.interactivebrokers.com/campus/trading-lessons/ib-key-two-factor-authentication-android/

The CISA landing page for the public Wi-Fi tip card was opened as well (https://www.cisa.gov/resources-tools/resources/best-practices-using-public-wi-fi-tip-card). It describes hotspots as not always secure and points to a download. The download address tried the same day did not return the card, so the travel tip card and the August 2024 publication are the CISA texts actually quoted above.

Know the risk

A tunnel does not change the result of a trade. Gold can fall for a long time, leverage can wipe out the money in an account, and a login that was protected on the way in can still be used to send an order you did not plan. Public rooms add theft of the device, a readable screen, and pages that are not the broker. Use a network control so the login is harder to copy. Do not use it as a reason to trade from a lobby.

The desk, the research tools, and the free calculators are a different product from a VPN.

Questions, answered.

Do I need a VPN for public WiFi?

Use one when the network is not yours: a cafe, hotel, airport, train, or any hotspot whose name you did not set. On a home network you control, with a current password and updates installed there, a personal VPN is optional. A VPN encrypts the path to its server. It does not make a trade safe, and it does not replace the broker's own login checks.

Is public Wi-Fi safe for online trading?

Treat it as a shared network you do not control. CISA's travel tip card says not to do sensitive work, banking, or shopping on a public wireless network, and to prefer your own mobile connection. If you still log in, confirm the network name with staff, keep the site on https for the whole visit, and turn on a second login factor before you travel.

Does a VPN hide my trades from my broker?

No. The broker still sees the account, the orders, and the address where the tunnel comes out. The cafe network stops seeing the broker's site and starts seeing a connection to the VPN server. You have moved the view from the cafe to the VPN company. Read that company's own logging policy before you rely on it.

Is a free VPN safe for a broker login?

A price of zero is not a security review. Read, on that provider's own site, how the service is paid for and what it says it stores. This article does not name a free app as safe or unsafe, because those pages were not the ones opened on 10 November 2026. Do not type a broker password into an app whose policy you have not read.

Can a VPN get a trading account restricted?

It can look, to the platform, as if you are in the country of the VPN server rather than the country you are sitting in. Some platforms limit who they serve. This article does not quote a house rule it did not read. Open the platform's own terms and the login page's country notice before you send an order through an exit address in another country.

Does a VPN replace two-factor authentication?

No. A VPN protects the path. A second factor protects the login if the password is copied. MetaTrader 5's help says a one-time password is asked on each connection when the broker's server has it enabled, except when you connect with the investor password, which is a view-only mode. TradingView's help says an authenticator app is more reliable than a text message. Turn the second factor on before you need it, on a network you trust.

Not financial advice. Trading involves risk.

See plans: https://baroqtech.com/pricing?utm_source=devto&utm_medium=organic&utm_campaign=vpn-public-wifi-trading
Join the free Telegram channel: https://t.me/baroqtech