No. Your browser already shows whether the connection to your bank is secure. The real risks are fake sites and stolen passwords, and a VPN stops neither.
What solves it instead
- Before you log in, check the symbol to the left of the address. Type your bank's address yourself or use its app, rather than a link in a message.
- Switch on Always use secure connections in Chrome.
- Use the two-step sign-in your bank offers, and never pass on a code to someone who calls or messages you.
The facts
| About | Word for word from the source | Source, checked on |
|---|---|---|
| What the symbol next to the address tells you | These symbols indicate whether Chrome has or hasn't established a secure and private connection with a site. | support.google.com, |
| When a site does not offer a secure connection | When Always use secure connections is on, if a site doesn't support HTTPS, Chrome displays a "Your connection to this site is not secure" warning. | support.google.com, |
| The real risk: fake sites and messages | Phishing is an attempt to steal personal information or break in to online accounts using deceptive emails, messages, ads, or sites that look similar to sites you already use. | support.google.com, |
| If your password is stolen anyway | With 2-Step Verification, or two-factor authentication, you can add an extra layer of security to your account in case your password is stolen. | support.google.com, |
| What EU law requires of your bank | Member States shall ensure that a payment service provider applies strong customer authentication where the payer: (a) accesses its payment account online | eur-lex.europa.eu, |
What a VPN does change
On a network you do not trust, such as hotel or airport Wi-Fi, a VPN hides from that network which sites you visit. That is a reason to use one there; it is not something banking needs in particular. Check when a VPN is worth paying for
Without a VPN
- You
- Your networkinternet provider, or the Wi-Fi of work, school or a café
Sees: which sites you visit and when. With HTTPS, not what you do there.
- The website
Sees: your IP address, and with it roughly where you are and who your internet provider is.
With a VPN
- You
- Your networkinternet provider, or the Wi-Fi of work, school or a caféEncrypted tunnel
Sees: only that you are connected to a VPN server, and how much data you send.
- VPN serverrun by the VPN provider
Sees: which sites you visit, as your internet provider did before.
- The website
Sees: the IP address of the VPN server. It still recognises you by your login and cookies.
What we did not check
3
- How individual banks secure their websites and apps.
- Whether your bank accepts logins through a VPN connection: we have not tested banks.
- The warnings shown by browsers other than Chrome.
Next step
- Before you log in, check the symbol to the left of the address. Type your bank's address yourself or use its app, rather than a link in a message.