Italian public Wi-Fi has its own rhythm. You order a coffee at the bar, ask for the password, and the barista points to a card taped by the till. On a Frecciarossa the connection holds until the train leaves the station. At Fiumicino, the first screen asks for your phone number.

None of that is automatically dangerous. But public networks here, as anywhere, are shared, occasionally mislabelled, and usually gated behind a portal that wants something before it lets you online. A few habits keep the convenience from costing you.

What's actually at risk

Someone reading every packet you send is mostly an old worry. HTTPS encrypts the great majority of ordinary browsing, so a stranger on the same network cannot watch your messages scroll past. The realistic problems are narrower.

• A network with a plausible name sitting next to the real one, run by someone else. The portal that opens is a copy, and the password you type goes to them.
• A portal that collects more than it needs: phone number, email, and marketing consent buried in small print.
• A laptop still broadcasting file sharing or device discovery to everyone on the subnet.
• The occasional unencrypted page, still common on small cafe and hotel networks, where whatever you type is readable.

Captive portals: what's normal, what isn't

Almost every venue puts a login page between you and the internet. It is a page you do not control, which is exactly why it deserves a second look.

• Confirm the name. Ask at the counter: qual è la rete? Some public hotspots run under the Wi-Fi Italia scheme, while bars use the venue's own name. Pick the exact string, not the closest match.
• Read the fields. A phone number and an SMS code is standard in Italy. A card number, a bank login or a photo of your ID is not. Close the page.
• Expect the Italian number problem. Some portals only send codes to Italian mobiles. If your foreign number never receives one, that is the network's limitation, not your mistake. Ask staff, switch networks, or use your own data.
• Start the VPN after the portal, not before. A tunnel running too early can block the very page you need to load.
• Use a spare email if you have to register. Marketing lists are the price of many free networks.

Cafes, trains and airports: what to expect

Bars and cafes

The password is usually on the receipt or a card by the till. Coverage is decent, the network is small, and you are probably staying twenty minutes with a phone in your hand. Fine for maps and messages; not the place for a bank transfer.

Trains

Frecciarossa and Italo both offer onboard Wi-Fi, usually through a registration portal, and it fades in tunnels and on long rural stretches. Regional trains often have none at all, which is worth knowing before you promise to work through a two-hour ride.

Airports

Fiumicino, Malpensa, Linate, Bergamo and the rest offer free Wi-Fi, generally with a portal and sometimes with a time limit. These are large, busy networks full of travellers, which makes lookalike hotspots more plausible than anywhere else. Match the network name to the signs in the terminal.

Do you need a VPN in Italy?

A VPN encrypts the link between your device and the VPN server, so the cafe's router sees only that you are connected, not what you are doing. That is a genuine benefit on an open network, and it is the whole of it. It does not make you anonymous, it does not save you from a convincing phishing page, and it does not stop a portal from collecting your number.

If you use one, pick a paid provider with a clear privacy policy, ideally one whose logging claims have been independently audited. Free VPN apps need a business model, and the usual currency is your data. Check too that the provider works on the network you are joining; hotel and airport systems sometimes interfere with VPN traffic.

Tasks to avoid, and what's fine

Think in terms of consequences, not categories. Reading reviews on a train is not the same as logging into your bank.

Leave for a private connection:

• Banking and payment apps, and any page where you type a card number.
• Anything involving identity documents: SPID logins, tax or health portals, passport uploads for a rental or hotel check-in.
• Work systems protected by a username and password alone.
• New account sign-ups that reuse your main email and password.
• Browser or plugin "update" pop-ups you did not ask for.

Fine on public Wi-Fi: maps, timetables, restaurant reviews, messaging apps, email with two-factor authentication switched on, streaming with your own login. Two-factor authentication covers a great deal of everything else, so keep it on for your important accounts.

A 60-second routine before you connect

1. Turn off auto-join for open networks, and forget any you no longer use.
2. Switch off file sharing, device discovery and public-folder features.
3. Check the network name against a sign or ask someone who works there.
4. Connect, clear the portal, then start your VPN.
5. Log out when you finish, and turn Wi-Fi off as you leave. Phones quietly rejoin networks they remember.

When your own connection is the better answer

Italy has solid mobile coverage in cities and along most main rail lines, and on an EU plan roaming usually comes out of your existing allowance. A short eSIM for Italy costs little and takes ten minutes to install before you fly. Tethering the laptop to your phone removes the portal, the shared network and the lookalike hotspot in a single move. Hotel and apartment Wi-Fi deserves the same caution as a cafe: it is shared, and you rarely know who set the router up or when it was last updated.

The short version

Use public Wi-Fi in Italy for the light things, and treat every login screen as something to read rather than click past. Verify the network name, refuse portals that ask for card details, keep two-factor authentication on everywhere, and move anything involving money, identity or work to your own connection. The cappuccino is still worth it.

Photo: Gustavo Fring / Pexels