Public Wi-Fi, QR codes, fake apps and browser safety

Cafés, malls, airports and campuses are full of convenient shortcuts: free Wi-Fi, a QR code menu, a handy app. Most are fine. A few habits help you spot the ones that are not.

Watch the 1-minute overview

Watch the full video guide for this module

Public Wi-Fi: an honest picture

• The US FTC says that because of widespread encryption, using public Wi-Fi is usually safe, but encryption does not protect you if you visit a scammer's website.
• The UAE Cybersecurity Council warned in August 2025 that more than 12,000 public Wi-Fi breaches had been recorded in the UAE since the start of that year, and that hackers target open networks in cafés, airports and malls (Gulf News).
• The Council warned of 'man-in-the-middle' attacks, where criminals intercept communications or redirect users to fake websites, and advised avoiding sensitive accounts such as banking or email on public Wi-Fi.
• The US NSA advises not connecting to open hotspots when more secure options exist, switching off Wi-Fi auto-connect, and 'forgetting' a public network when you finish, because attackers can copy familiar network names (Malwarebytes).
• Simple option: for banking or anything sensitive, use your mobile data instead of free Wi-Fi.

VPNs in the UAE: useful, but use them lawfully

• The UAE Cybersecurity Council recommends a reliable VPN on public Wi-Fi to encrypt your connection (Gulf News, 2025).
• The legal position on personal VPN use is not simple. Khaleej Times (2021) quoted a lawyer saying VPN use is not illegal if it follows UAE government guidelines, and cited a 2016 regulator statement that VPNs may be used by companies, institutions and banks for internal purposes.
• The same report says UAE law treats using a false or third-party network address to commit a crime, or to hide one, as a serious offence with heavy penalties.
• So keep it simple: only use a VPN provided by your school, university or employer, or one a parent or trusted adult has approved, and never to get round blocked services or for anything unlawful.
• Avoid free VPN apps from unknown developers: a VPN can see your traffic, so it must be one you trust.

QR codes: look before you leap

• The FTC warns that scammers hide harmful links in QR codes, which can lead to spoofed sites that look real or install malware (CNBC).
• Criminals may stick their own codes over real ones, for example on parking meters (FTC, via CNBC).
• Dubai Municipality has said that every QR code you scan has the potential to be fraudulent (Khaleej Times, 2025).
• Its advice: check the link begins with https before opening it, be cautious with codes on walls or in public places and find out who posted a code before scanning, and avoid entering passwords or bank details on sites opened from a QR code unless you are sure they are safe.
• Do not scan a QR code in a message you were not expecting (FTC). If it claims to be from a company, go to the company's app or website yourself.

Fake and risky apps

• Get Safe Online warns that tampered versions of real apps spread through unofficial channels and can let attackers take control of a phone. Download apps from official stores (Get Safe Online; see also the UAE Cyber Security Council advice in lesson cy-01).
• Research an app and check its reviews before downloading (Get Safe Online).
• Read permission requests carefully. If a request makes you uneasy, deny it or search for an alternative app (Get Safe Online).
• Check the developer name carefully: fake apps often copy a well-known app's name and logo.
• Turn on a passcode for purchases, or switch off in-app purchases where your phone allows it, to avoid surprise charges (Get Safe Online).

Browser safety in five settings

• Keep your browser updated: Duke University's security office says always run an up-to-date version.
• Be choosy with extensions: they are written by third parties who may not have been vetted. Check how many people use one, what access it asks for, its reviews and when it was last updated (Duke).
• The padlock means the connection is encrypted, not that the site is honest. A scam site can have a padlock too (FTC).
• Block pop-ups and set your browser to ask where to save downloads, so nothing installs quietly (Duke).
• Check web addresses letter by letter for misspellings or swapped letters, even when they look familiar (FTC, via CNBC).

Bluetooth and nearby connections

• The NSA advises switching Bluetooth off when you are not using it (Malwarebytes).
• Do not accept pairing requests you did not start (NSA, via Malwarebytes).
• Turn off AirDrop or Nearby Share receiving from 'everyone' when you are in public, so strangers cannot send you files or images.