A VPN wouldn't have stopped my dad from reading his gift card numbers over the phone to a man pretending to be from the IRS. It wouldn't have stopped the skimmer that cloned my card at a gas pump two years later, or the pile of identity theft paperwork I filed with the FTC afterward. I get some version of that question anytime someone finds out I never open a browser on public Wi-Fi without a VPN running, and there isn't a clean yes-or-no answer here. If a security company gives you one, that's usually the moment to close the tab.
Quick disclosure before we go further, since I hate when sites bury this at the bottom: this page has affiliate links, and if you sign up for something like Norton 360 with LifeLock through one of them, I earn a small commission at no extra cost to you. I only link to services I actually pay for on my own household and my parents' accounts. None of that changes the technical answer below, so let's get into what a VPN is actually built to do.
What a VPN's Encrypted Tunnel Actually Covers
A VPN takes whatever leaves your laptop or phone — a login form, a card number, a password — and wraps it in an encrypted tunnel before it ever touches the public network. Most decent VPNs, including the one bundled into Norton 360 with LifeLock, use AES-256 encryption on that tunnel, the same grade banks use on their own traffic. That buys you exactly one thing: the stranger two tables over, running software to sniff packets off the same Wi-Fi, sees scrambled noise instead of your actual data. Think of it as a locked front door. Nothing wrong with a locked front door; you should absolutely have one, but a lock only stops the person trying to get in through that specific door.
Where Does That Tunnel Stop Protecting You?
Here's the part the ads leave out. A VPN encrypts the pipe, but it has no opinion about what you put into that pipe. Type your password into a fake login page that looks identical to your bank's, and the VPN faithfully encrypts that password and sends it straight to the scammer. It did its job perfectly, and you're still cleaned out. It wouldn't have stopped the fake IRS caller who talked my dad into loading almost $5,000 onto gift cards, and it wouldn't have stopped the skimmer that cloned my card at the pump — I wrote up how to spot gas pump skimmers after that turned into a $1,000 furniture bill on my statement.
There's a second layer past phishing that matters more for anyone doing real work over public Wi-Fi: session hijacking and browser exploits that ride in on a bug, not on the network. If your inbox gets compromised, that one account can reset half your other logins, which is why I treat email as the master key to everything else rather than just another app. A cloned SIM card hijacks your phone number the same way, routing your two-factor codes to someone else's phone instead of yours, and a cloned voice on a callback can talk a family member past verification a VPN was never built to touch. Anyone working remote and handling sensitive files should know how to spot employment identity theft, because those scams don't care whether your Wi-Fi was encrypted.
The Real Risk of Public Wi-Fi at the Mall
Most of what people picture when they hear "public Wi-Fi hacking" — someone parked outside SouthPark Mall, cracking open strangers' laptops — is rarer than it used to be. Nearly every site you actually log into now runs its own encryption (that little padlock in the address bar), which means a VPN is mostly adding a second lock on top of a door that was already shut. The more realistic risk in a mall food court isn't a stranger reading your traffic — it's a rogue access point named something close to the mall's real guest network, sitting there collecting whatever connects to it. A VPN does help against that particular trick, since your traffic gets encrypted before it ever reaches the fake router. That part of the marketing happens to be true. It's just not the whole picture.
Three Checks Before You Trust Any Public Network
One VPN app I tried early on and dropped fast was a free one that kept showing up in app store ads (you know the kind). I read its privacy policy on a whim one night and realized it was logging more about my browsing habits than the open mall Wi-Fi ever would have. Free VPNs have to make money somehow, and it isn't always by protecting you. I deleted it within the month and stuck with the VPN already bundled into the paid suite I use now.
Before I connect to anything outside my own house, I run through the same three checks, and none of them require technical background. First, I look at the network name itself — if it's slightly off from what the venue calls its Wi-Fi, or there are two networks with nearly identical names, I skip both and switch to my phone's data. Second, I confirm the VPN is actually connected before opening anything sensitive, not after, since a VPN that turns on a few seconds late has already let that first login request go out unprotected. Third, and this is the one people skip: I still avoid logging into anything financial on public Wi-Fi even with the VPN running, because the tunnel protects the trip, not the destination — if the site I'm logging into was already breached somewhere else, the VPN can't undo that.
What Norton 360's Bundle Catches That a VPN Never Will
A VPN can't tell you when your information leaks somewhere you never controlled — a retailer's database, a hospital system, a data broker site you've never heard of. I was loading groceries into the car in the Costco parking lot when my phone buzzed with a LifeLock alert: someone had tried to open a new account using my information, nowhere near any Wi-Fi network I'd touched that day. No VPN setting catches that, because the leak didn't happen on my laptop — it happened at whatever company was holding my data in the first place.
This is the layer most people skip, because it isn't as satisfying as flipping a VPN toggle. Credit monitoring watches for new accounts opening in your name. A credit freeze is a blunter, free tool that stops most new accounts from opening at all, which is a different job than monitoring and not a substitute for it. Dark web scanning tells you when your email or password shows up somewhere it shouldn't, useful but always after the fact. Reimbursement coverage, where a plan includes it, is a separate promise again — insurance for the cleanup, not prevention — and it's worth reading what actually triggers a payout versus what just gets you a support line. Your Social Security number carries its own exposure risk none of this touches directly, and data broker removal services slowly chip away at how many sites are selling your address and phone number in the first place.
I ended up on Norton 360 with LifeLock because it puts the VPN and that monitoring layer under one login instead of three separate apps I'd forget to check. But owning the right tool and actually using it are two different things. I bought a cross-cut shredder the same season as my dad's scam, fully intending to destroy sensitive mail the day it arrived, and then watched six months of statements and pre-approved credit offers pile up in a "to shred" bin next to the printer instead. The shredder never protected anything sitting in that bin. Software works the same way — a monitoring service you never open the app for is just an expensive icon on your phone.
My friend Marguerite Seals, who I've known since we were in the same neighborhood book club, works in mortgage lending and keeps meticulous paper records out of habit from that job. She was the one who first pointed out that a fraud alert and a credit freeze are not the same protection, and that filing one doesn't automatically cover what the other does. That mix-up trips up more people than you'd think, and it has nothing to do with whichever VPN you're running.
Public Wi-Fi gets all the attention, but I spent just as much time locking down the network at home after everything happened — new router admin password, guest network split off from our real one, that sort of thing. I wrote up the specifics in how I secured my home Wi-Fi, because plenty of people worry about the coffee shop and never touch the router sitting in their own closet.
So, Is a VPN Enough?
So, is a VPN enough? No, and anyone selling you one as a complete answer is selling you a locked door and calling it a house. Use one, always, especially anywhere you don't control the network. But pair it with something that watches for the damage a VPN was never built to catch: a credit freeze, an alert service, an actual habit of checking your own accounts instead of assuming an app is handling it for you.
A reader named Simeon Hartley emailed me a while back, skeptical that any paid monitoring service would have caught what happened to his mother — a stranger using her insurance information at a clinic states away. He's not wrong to be skeptical. No VPN, no monitoring subscription, no single tool catches everything; the honest pitch for any of this is "catches it faster," not "stops it cold."
For my parents specifically, Norton 360 is what I settled on, mostly because it's one thing to explain instead of three — I tell my dad to make sure the icon is green, and that's about the extent of the technical conversation we need to have. If you want to see how the VPN, the monitoring, and the reimbursement pieces actually fit together instead of just taking my word for it, I broke it down in using Norton 360 for bank account protection. Turn the VPN on. Just don't mistake it for the whole job.