Queensland Government Safer Schoolies says Schoolies Week 2026 on the Gold Coast runs 21–27 November — Saturday through Friday. That week is a lot of phones on Wi-Fi someone else runs: the hotel, the apartment, a café, a beach kiosk, a venue.

Most of that is ordinary shared internet. The habits still matter. Confirm the real name. Turn off auto-join. Use HTTPS. Keep banking and ID on mobile data when you can. A VPN encrypts the path on untrusted Wi-Fi. It does not make you anonymous, and it does not stop phishing or scams.

The short version

  • The calendar: Gold Coast Schoolies Week 2026 is 21–27 November, according to Queensland Government Safer Schoolies.
  • Hotel, apartment, café, beach and venue Wi-Fi are networks you do not control.
  • Confirm the name with staff or on a sign. Prefer a password-protected network. Turn off auto-join.
  • Look for https. A page that asks for email or a social login to get “free Wi-Fi” is a reason to stop.
  • Do not log into banking or upload ID on open Wi-Fi. Use mobile data or your own hotspot for those.
  • Keep phones updated. Turn on multi-factor authentication (MFA) on email, banking and social accounts.
  • A reputable VPN encrypts traffic on untrusted Wi-Fi. Arresti is Australian-owned and veteran-owned. No-logs. From AUD $3.99 a month or $43 a year, up to 5 devices, 30-day money-back.

What public Wi-Fi looks like at Schoolies

Hotel and apartment Wi-Fi usually share one password across the floor. Café Wi-Fi is the same idea with a shorter code on a receipt. Beach and venue networks are busier: more devices, more similar names, and more people joining without looking twice.

None of that makes every café a trap. It means you treat the network as someone else’s.

The Australian Signals Directorate’s Australian Cyber Security Centre public Wi-Fi guidance puts it in practical terms. Anyone can create a free hotspot. Names are not unique. Check the name on signage, or with staff. Disable auto-join. Prefer a password-protected network. Forget the network when you are done. If you are not sure, use mobile data. Look for https and the lock, and leave if the browser warns you. Turn off file sharing, and mark the network as public. Think twice before banking or sending ID. If you use public hotspots often, install a reputable VPN, and read the provider’s privacy policy.

That is the official advice. It is also enough.

Fake hotspots that look like a venue’s network

Wi-Fi names are not unique. Anyone can broadcast a label that looks like the hotel, the apartment block, or the venue on the poster. Your device only sees the name. If that name matches one it already trusts, it may join automatically. That is the whole trick.

We covered the same pattern at airports in Fake airport Wi-Fi: how evil twin hotspots work. Schoolies just moves the setting: a lookalike “Hotel_Guest”, a “Venue-Free-WiFi”, or a café name with one extra letter.

Watch for:

  • The name is close, but it is not on the sign, the room card, or the staff note.
  • A second network with almost the same name sits next to the real one.
  • The portal asks for an email, a social login, or a password you would not give a hotel desk.
  • Your phone joined something before you tapped it.
  • The browser warns you. Stop. Forget that network.

Safe habits on hotel, café, beach and venue Wi-Fi

  1. Confirm the network name with staff, on the hotel card, or on official signage.
  2. Turn off auto-join and auto-connect for public hotspots.
  3. Finish the real captive portal first — terms or a room number — then connect a VPN.
  4. Use HTTPS. Leave if the browser warns you.
  5. Turn off file sharing. When asked, mark the network as public.
  6. For banking, ID scans, or anything you would not do on a stranger’s laptop, use mobile data or your own hotspot.
  7. Forget the network when you leave the café, the beach, or check out.
  8. Keep the phone updated. Updates close known holes; skip them and you keep yesterday’s bugs.
  9. Turn on multi-factor authentication on email, banking and the accounts you actually use. A VPN does not replace that second step.

For the October café and holiday-weekend note, see Public Wi-Fi on the last weekend of the QLD school holidays.

What a VPN does — and what it does not

A VPN encrypts the path from your device to a VPN server. On hotel or venue Wi-Fi, that means the local network is not reading your traffic hop by hop. That is the job.

It does not make you anonymous. Logged-in sites still know you. It is not antivirus. It does not stop phishing or scams. It will not undo a password you typed into a fake portal. Those limits make the purchase honest. You are buying encryption on networks you do not run. You are not buying a new identity, and a VPN is not a substitute for the habits above.

Using a VPN is legal in Australia for ordinary privacy and security. If that question is sitting in the back of your mind — or a parent’s — read Is a VPN legal in Australia?

If you want a public Wi-Fi VPN from a company that is here, Arresti is Australian-owned and veteran-owned. How that compares with overseas brands is in Australian-owned vs overseas VPN brands. No-logs: we do not store browsing history. We do collect what we need to run your account — email, country, and payment through Stripe on the web.

From AUD $3.99 a month or $43 a year. One plan. Up to five devices. 30-day money-back. Apps for iOS, Android and macOS. Windows from the download page. Plans and the money-back terms are on pricing.

We wrote down what “no-logs” actually means. If that sentence matters, read it, and the Privacy Policy.

A note for parents

If you are sending someone to Schoolies, the useful move is the same one you would make for any trip: set the habits before they leave, not after they join the first open network.

One Arresti plan covers up to five devices, so a family can cover several phones — yours, theirs, a sibling’s — on the same subscription. Install at home. Confirm they can tap Connect. Remind them that banking and ID stay on mobile data. The VPN is the extra hop on untrusted Wi-Fi. It is not a remote babysitter, and it will not stop a scam message.

Official Schoolies safety info

For general Schoolies Week safety — not Wi-Fi — Queensland Government Safer Schoolies is the official starting point. Red Frogs are part of that on-the-ground support. If you want the official week-safety pages, start there, then come back to the network habits above.

Install before you travel if you can. Confirm the real network. Connect the VPN. Use Schoolies hotel, café and venue Wi-Fi as a shared network — with one extra, quiet hop on the path.

See plans