Black Friday 2026 lands on Friday 27 November, with Cyber Monday following on 30 November. Plenty of those deals will be bought on a phone: in a café queue, at the airport gate, or on the shopping-centre Wi-Fi between stores.

That’s convenient. It also means typing logins and card details on a network someone else runs. Here’s how to shop the sales on public Wi-Fi safely, and where a VPN does and doesn’t help.

The short version

  • Where you can, pay on mobile data or your own phone hotspot, not free Wi-Fi.
  • If you must use public Wi-Fi, confirm the network name with staff or signage and turn off auto-join.
  • Shop with retailers you know. Type the address yourself rather than tapping links in sale emails, texts or ads.
  • Pay with a credit card, PayPal or a digital wallet such as Apple Pay or Google Pay. Never by bank transfer, gift card or crypto.
  • Turn on two-factor authentication (2FA) for your email, shopping and payment accounts.
  • Keep your phone, browser and apps updated before the sales start.
  • A VPN encrypts your connection on public Wi-Fi. It does not stop scam websites, phishing or a breach at the retailer’s end.

Is public Wi-Fi safe for shopping?

Mostly, public Wi-Fi is just shared internet. The problem is that you can’t see who else is on it, or who set it up.

The Australian Cyber Security Centre’s public Wi-Fi guidance is blunt about it: anyone can create a free hotspot, including cybercriminals, and Wi-Fi names are not unique, so a criminal can copy a real venue’s network name. Its mobile phone advice says information sent over public Wi-Fi may not be private, including passwords, credit card details and banking information, and that attackers could redirect you to malicious pages.

Its online shopping guidance goes further and recommends avoiding financial transactions on public Wi-Fi altogether, naming shopping centres and cafés.

To be fair to the cafés: most reputable checkout pages use HTTPS, which encrypts what you type between your browser and the store. The bigger public Wi-Fi risks are the ones around that:

  • Fake “free Wi-Fi”. A lookalike network set up to watch traffic or push you to a fake login page.
  • Dodgy sign-in pages. A hotspot page asking for your email password or card details before you get online.
  • Redirects. Being steered to a copycat of the store you meant to visit.
  • Auto-join. Your phone quietly reconnecting to a network name it has seen before.

Watch for fake “free Wi-Fi” and evil twin hotspots

A busy shopping centre on sale weekend is exactly where a lookalike network blends in. An “evil twin” copies a real network name, or something close to it, and waits for phones to join. We explained how they work in Fake airport Wi-Fi: how evil twin hotspots work, and the same trick works at a food court.

Before you connect:

  1. Check the exact network name on a sign or with staff, and be wary of two networks with nearly the same name.
  2. Prefer a password-protected network over an open one.
  3. If your browser shows a security warning, stop, disconnect and “forget” the network.
  4. Turn off auto-join for public hotspots, and forget the network when you leave.

If you’re unsure, don’t connect. Mobile data is the safer option for anything involving money.

Black Friday scams: the risks Wi-Fi can’t fix

Often the bigger risk isn’t the network. It’s the shop.

According to the National Anti-Scam Centre’s Targeting Scams report for 2025, more Australians reported losing money to shopping scams than to any other scam type in Scamwatch data, with 12,248 people reporting total losses of $10.8 million, a 22.2% increase on 2024.

Scamwatch warns that scammers set up fake websites, copy real stores and post fake ads and reviews, often with prices that look too good to be true. Warning signs it lists include no terms and conditions, ABN or privacy policy on the site.

The ACSC’s shopping guidance adds a few more red flags:

  • prices that are unbelievably low
  • pressure to pay immediately, or to pay by bank transfer, gift card or digital currency
  • no contact details, returns policy or dispute process
  • card details being requested for reasons other than your purchase.

None of these are network problems, and no VPN will catch them. Check the seller before you pay.

How to shop the sales safely, on any network

Shop where you know. Go to retailers you already trust. Type the address yourself or use the retailer’s official app, rather than following a “70% off” link in an email, text or social ad.

Check the URL. Look for small spelling changes and odd endings in the web address. HTTPS and a padlock mean the connection is encrypted. They don’t mean the business is honest.

Pay in a way you can dispute. The ACSC recommends secure payment methods like PayPal, BPAY, Apple Pay, Google Pay or a credit card, because there are dispute processes if things go wrong. It also suggests a separate low-limit card just for online shopping. If you use PayPal, choose “goods and services”, not “friends and family”.

Don’t save your card everywhere. The ACSC advises against saving payment details in shopping accounts or your browser. If you do save them, protect the account with 2FA.

Turn on 2FA. Switch on multi-factor authentication for email first, then shopping and payment accounts. A stolen password is far less useful without the second step.

Use mobile data for checkout. Browse on café Wi-Fi if you like, then switch Wi-Fi off before you pay.

Where a VPN helps, and where it doesn’t

A VPN encrypts the connection between your device and the VPN server. On café, airport or shopping-centre Wi-Fi, that means the local network and anyone snooping on it can’t read your traffic or tamper with it on the way through. The ACSC’s mobile advice suggests considering a VPN on your phone when using public Wi-Fi.

Here’s what a VPN won’t do:

  • It won’t stop you buying from a scam website.
  • It won’t block phishing emails or texts, or a fake login page you choose to fill in.
  • It won’t protect your details if a retailer you shop with is breached.
  • It doesn’t replace 2FA, updates or careful payment choices.

Think of it as protecting the road, not checking the shop at the end of it. For more background, see Public Wi-Fi in Australia: what to know.

Getting set up before Black Friday

If you want that extra layer for the sales, Arresti is an Australian VPN service. One plan covers up to 5 devices, with apps for iOS, Android, Windows and macOS. Plans are monthly or annual, and there’s a 30-day money-back guarantee. You can subscribe on the web or in-app through the App Store or Google Play.

Install it before 27 November, connect before you join public Wi-Fi, and keep the habits above for everything a VPN can’t cover.

See Arresti plans and pricing

FAQ

Is it safe to shop on public Wi-Fi?

It carries more risk than your home network or mobile data, because you don’t control who runs the network or who else is on it. The Australian Cyber Security Centre recommends avoiding financial transactions on public Wi-Fi. If you can, switch to mobile data for checkout.

Does a VPN protect my credit card details?

A VPN encrypts your connection on public Wi-Fi, which protects the data you send from snooping on that network. It won’t protect your card if you enter it on a scam website, respond to a phishing message, or shop with a retailer that is later breached.

What’s the safest way to pay during Black Friday sales?

Use a payment method with a dispute process, such as a credit card, PayPal (goods and services), or a digital wallet like Apple Pay or Google Pay. Avoid paying by bank transfer, gift cards or cryptocurrency, which are hard to recover.

How do I spot a fake Black Friday deal?

Be wary of prices that are far too low, pressure to pay immediately, missing contact details, ABN, returns or privacy information, and unusual payment requests. Check the web address, and go to the retailer’s site yourself.

Sources