Banking on Café Wi-Fi in India: What Is Actually Protected

Everyone in India has read the advice: do not check your bank balance on café Wi-Fi, someone will steal your password. It made sense in 2012. It is largely wrong now, and repeating it does more harm than good, because it teaches people to fear the wrong thing.

What Is Already Safe

Your bank's app and its website use TLS, and the serious ones pin their certificates, which means the app refuses to talk to anything that is not genuinely the bank. Somebody sitting on the same café network in Pune with a packet capture running does not get your customer ID, your password or your UPI PIN out of that stream. They get ciphertext. The same is true of your email, your messaging apps and any large site you use. This is a real improvement and it is worth saying out loud rather than pretending the sky is falling.

What Is Still in the Open

The destinations. Before your phone can reach a service it looks the name up, and that lookup is visible to the network, along with the size and timing of whatever follows. So the café's router does not learn your balance, but it does learn that you bank with that bank, that you opened it at 11:40, that you then spent twenty minutes in a payroll portal belonging to a company whose name is in the address, and that you check one particular app roughly every ten minutes.

Whether that matters depends entirely on who is on the other side of it. On a network you have never seen before, in a place you are not a regular, the honest answer is that you do not know.

What a VPN Changes, and What It Does Not

A VPN puts all of that inside one encrypted connection to a server you chose. The local network sees one address and no names, no pattern, no per-app breakdown. That is the specific thing it fixes.

What it does not fix:

• Your device. A phone with something nasty already on it is compromised with or without a tunnel.
• Being tricked. A fake bank page you type your credentials into works exactly as well over a VPN. Most money actually lost in India goes this way, not to Wi-Fi eavesdropping.
• Anonymity. The local network stops seeing your traffic and the operator you picked starts seeing it. That is a move, not a disappearance.
• The rules. Using a VPN is lawful in India and it does not change what you are allowed to do online.

Doft VPN

Doft VPN gives you every server location free, with no paywalled regions, and connects in one tap on Android and iOS. It uses VLESS with Reality — current cryptography, a cheap handshake, and a connection that holds while your phone moves between Wi-Fi and mobile data. Premium adds higher speeds and raises the data allowance; the protection itself is the same on both tiers.

Use it for the real problem: not the password, which is already covered, but everything the network learns around it.