Before you sign in to a bank over public Wi-Fi, check the page you are about to use. The Federal Deposit Insurance Corporation (FDIC) says to share sensitive information only on official, secure websites. A page loading on a public network does not establish that it belongs to your bank, and a familiar-looking logo is not proof. As of February 28, 2026, the checks below offer a focused starting point, not a complete test of every network or website risk.

  1. Check the site’s identity. For a United States government site, look for the .gov domain. For a bank site, .gov is not the right test. Confirm that the address belongs to the bank you intended to reach.
  2. Check the connection. Look for an address beginning with https:// or a lock indicator. The FDIC recommends this check for secure .gov sites, and the Federal Trade Commission (FTC) explains that HTTPS encrypts information sent to a site.
A laptop open on a worn kitchen table beside folded reading glasses and a closed bank envelope, lit by soft window light while someone checks a website before logging in.
Two checks before entering account information: confirm the site’s identity, then confirm its HTTPS connection. Passing these checks does not verify the public Wi-Fi network itself.
  1. If either check fails, stop before entering sensitive information. The FDIC says not to share such information on a site without a secure lock or https://.
  2. If both checks pass, understand what they establish. They are evidence about the website address and the connection to it. They do not prove that the Wi-Fi network is legitimate or that every part of the situation is safe.

Why the website matters more than the network

Public Wi-Fi is the setting, but the website is where you may type a password, account number, or Social Security number. The FDIC’s guidance focuses on sharing sensitive information only through official, secure websites. That means a working connection is not enough. You also need to know that the page is the one you meant to visit.

A copied page can use a bank’s name, colors, and logo. Those visual details may look convincing, but they do not confirm the address. Check the web address itself before entering information. If you cannot tell whether it belongs to the bank, do not treat the page’s appearance as proof.

There is an important limit to the available guidance. The FDIC and FTC materials cited here do not say that every public Wi-Fi network is unsafe, and they do not provide a complete list of public-network risks. They also do not explain how to determine whether a particular Wi-Fi network is genuine or a lookalike. A website check answers only part of the question.

What .gov and HTTPS tell you

A .gov address has a specific meaning: official .gov websites belong to an official United States government organization. That makes the domain a useful identity check when you are visiting a government website. It does not apply to a bank’s regular website, so do not expect a bank site to end in .gov.

HTTPS addresses a different question. The FTC explains that the “s” in https:// indicates that information you submit is encrypted while it travels across the network. Encryption scrambles the information in transit, making it harder for someone between your device and the site to read it. The FDIC also advises looking for https:// or a lock indicator when checking whether a .gov site is connected securely.

Here is the distinction: the domain helps you assess who operates a government site, while HTTPS indicates that the connection is encrypted. HTTPS alone does not show that a page is the real bank or government website. A copied page can also use an encrypted connection. For a government page, check both its .gov address and its HTTPS indicator. For a bank page, check that the address corresponds to the bank and that the connection uses HTTPS.

How to use the checklist before you log in

Apply the checks before you type, rather than after a page asks for a password. First, look at the address and decide whether it matches the organization you intended to reach. If it is a government site, check for .gov. If it is a bank, look for the bank’s own web address rather than expecting a government domain. Then check for https:// or the lock indicator.

If one of those checks fails, pause. The FDIC says a site without a secure lock or https:// should not receive sensitive information. A page that looks official but lacks the secure-connection indicator does not meet that guidance. Likewise, HTTPS does not resolve doubts about whether the address is the right one.

If both checks pass, they provide useful evidence, but not a guarantee of safety. The checks described here do not verify the Wi-Fi network, assess the security of your device, or cover every way a site or account could be at risk. Treat them as a narrow pre-login screen, not as a certification that all risks have been removed.

Where the official guidance stops

The FDIC and FTC excerpts reviewed for this article do not explain how to verify that a public Wi-Fi network is legitimate rather than a spoofed copy. They also do not give specific instructions about banking apps, virtual private networks (VPNs), or turning off automatic network joining. Those are separate topics and would require guidance that addresses them directly. This article does not infer steps on those subjects from the website checks.

The cited material also does not set out what to do if a bank login or account activity seems compromised after using public Wi-Fi. In that situation, use the bank’s official contact channels and consult consumer resources from the FDIC and the FTC. Make sure you reach those resources through their official sites. The steps in this article are general education, not personal financial, legal, or tax advice. For questions about your own circumstances, check official guidance or speak with a qualified professional.

Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.