Using a VPN for Online Banking? You Might Be Solving the Wrong Problem
If you look up just about anyVPNalong with the words “online banking,” you’ll likely be flooded with dozens of blog posts espousing the merits of using that VPN to secure your finances. This marketing. . .
If you look up just about anyVPNalong with the words “online banking,” you’ll likely be flooded with dozens of blog posts espousing the merits of using that VPN to secure your finances. This marketing material often claims that a VPN will stop fraudsters from stealing your credentials or spying on your web traffic, but that fear-based fiction is a long way from reality. Using a VPN helps protect your privacy by preventing your internet service provider (ISP) from tracking your browsing activity and selling that data to advertisers. In addition to enhancing privacy, a VPN can give you access to region-specific content libraries on streaming services such asNetflix. It’s also an essential tool for anyone who downloads files throughtorrenting. That said, you don’t need a VPN to access your online bank account. In fact, using one might do more harm than good. Here’s why VPNs don’t mesh well with online banking and what you can do to actually make sure your connection is secured against threats. HTTPS Is Enough to Secure Your Online BankingPublic Wi-Fi used to be a battleground full of potential threats. In the early 2010s, you might fall victim to aman-in-the-middleattack where someone hijacks your logins if you happen to use their enticingly named fake Wi-Fi network. Those days are, essentially, over. HTTPSsecures the vast majority of websites by default. What that means in practice is that anyone monitoring your connection can only see the domain names of sites you visit. HTTPS encrypts all other information by default. For example, a snooper could see that you visited Reddit. But they wouldn’t be able to pilfer your login information or see the specific subreddits that you visited. Even the landing page's content would be a mystery to them. The blur represents the encryption that HTTPS uses. A hacker would only be able to see the URL of the page you visit while all webpage content would be obfuscated. (Credit: PCMag/Reddit)There are rare instances in which hacking can still succeed if a malicious party tricks you into visiting an older, insecure HTTP site. However, this sort of attack occurs throughphishingattempts and scam emails rather than through MiTM attacks. Scam protection toolswill serve as a much better defense than any VPN in those cases. Google's warning that a site is not secured by HTTPS. (Credit: PCMag/Google)Search engines like Google will be quick to tell you if you’re heading to a legacy site that hasn't been updated to HTTPS. You’ll get a warning like the one in the image above. Notice how the URL is in red, indicating it isn’t secure, not to mention the large warning that fills the entire window. It’s best to heed your search engine’s warning here unless you know for certain the site you’re going to is safe and won’t compromise your personal information. Banks Don't Trust VPN ConnectionsIronically, attempting to prevent fraud by using a VPN on your online bank account makes it more likely to set off alarm bells at your financial institution. The connection might look suspicious on the bank’s end, especially if you’re suddenly connecting from a location that you’ve never been before. A sudden connection to your account from Australia when you were in the US a couple of hours ago will raise a bright red flag for an impossible travel route. Banks build behavioral profiles to prevent fraud. Any unusual activity can result in your accounts being locked down until the fraud team is assured they haven’t been compromised. This can be a huge hindrance if you’re traveling and need to use your cards. That’s why some institutions still require travelers to submit a notice before going abroad; the bank’s fraud detection system might lock your account if it detects your card being used in another country. Practically speaking, a VPN isn’t necessary for an online banking session either. HTTPS already encrypts your credentials. The most a VPN will do is hide that you visited your bank’s website from any onlookers, such as your localinternet service provider(ISP). That information won’t do a hacker much good unless they follow up with a targeted spear-phishing attack using your institution's name. Such an attack is possible, but the slight benefit of using a VPN to hide your domain name is outweighed by the trouble it can cause accessing your accounts. How to Actually Stay Safe While Online BankingBanking scams abound, and a VPN won’t prevent the most common infiltration methods. Apassword managercan keep your credentials secure in the event of adata breach. The topantivirus softwarecan help mitigate phishing attacks, and most include built-in scam-detection tools. Your best bet is to avoid suspicious calls, texts, or emails from individuals claiming to be your bank. Your financial institution should never reach out to you and ask for account passwords. If they do, hang up or stop replying and dial the number on the back of your credit or debit card to ensure you’re routed to the correct place. Finally, we still consider VPNs an essential part of your online safety toolkit—even if you don't need one for banking.