Are VPNs Safe and What Risks Should I Know?

Safety has three different questions people mix together:

1. Is the tunnel doing its job? Encrypted traffic on café Wi-Fi, a different visible IP, DNS not leaking to your ISP.
2. Is the company a reasonable custodian? Clear policy, official apps, a refund you can actually use.
3. Does it make you untraceable? No. Logged-in accounts, cookies, and malware still work.

A good consumer VPN can pass (1) and be acceptable on (2). It never fully delivers (3). If someone promises “military anonymity,” treat that as marketing.

On public Wi-Fi (airport, hotel, campus, coffee shop) a VPN stops casual snooping on the local network. HTTPS already encrypts many websites, but a VPN also covers apps, DNS, and sites that still do sloppy things.

At home, the main gain for US users is reducing what the ISP can observe. After 2017, broadband privacy rules that would have limited ISP data sales were rolled back. A VPN does not stop the ISP from seeing that you connected to a VPN. It should stop the ISP from seeing the destinations inside the tunnel.

For travel, a home-region server can keep accounts and subscriptions behaving the way they do in the US. Results vary by service and are not something we score as a lab pass/fail.

None of this replaces updates, unique passwords, or two-factor authentication.

• Free or unknown apps — Some monetize by logging, injecting ads, or reselling bandwidth. A 2020 academic look at free Android VPN apps found tracking libraries and worse in a large share of the sample. Prefer a paid app or a free tier run by a known paid company. See free vs paid.
• Trust transfer — You stop showing destinations to your ISP and start showing them to the VPN operator (unless they truly do not keep activity records). Read the current policy yourself.
• Dropped tunnels — Without a kill switch, a brief disconnect can expose your real IP to a site or a torrent swarm.
• False confidence — People reuse passwords and click phishing links while “on a VPN,” as if the tunnel cancels the mistake.
• Jurisdiction theater — A Panama or Swiss HQ is not magic if the company still keeps account data and payment records. What they store matters more than the flag on the About page.
• Blocked or flagged logins — Banks and streaming apps sometimes challenge VPN IPs. That is an inconvenience, not a safety proof.

A VPN does not scan files on your disk. It does not stop you from typing a password into a fake bank page. It does not hide activity from Google if you are logged into Chrome. It does not make illegal activity legal.

Some apps include a “threat protection” or ad-blocking toggle. Those are usually DNS or domain blocklists. Useful, limited, and not a replacement for Windows Defender or whatever you already run on the phone.

If your question is “can a VPN give me a virus?” — official installers from major brands are ordinary software. Sideloaded “modded premium” APKs and fake search-ad download buttons are a common way people get malware that *looks* like a VPN.

1. Download only from the provider website or the official App Store / Google Play listing.
2. Enable kill switch and auto-connect on untrusted Wi-Fi.
3. After connect, run What Is My IP, DNS leak, and WebRTC leak.
4. Read the privacy policy date and what they say they keep (account email, payment, connection timestamps).
5. Use the refund window on your own ISP before you commit to a multi-year plan.
6. Keep expecting account-level tracking. The VPN is one layer.

For a buyer checklist that is not safety-only, see how to choose a VPN.

We compile this page from public incidents, provider documentation, and standard network behavior. First-party tests appear on review pages when a dated How-we-tested note is published. We do not claim to have certified any provider’s no-logs infrastructure, and we do not invent malware-lab scores for VPN apps.