Secordit home
Contact

What is a man-in-the-middle attack?

A man-in-the-middle attack, often shortened to MITM, is when someone sits between you and the service you think you are talking to. They can read or alter the traffic. On a network you do not control, unencrypted traffic is easier to intercept. HTTPS and TLS are designed to protect web and many mail connections in transit. 123

By Secordit. Last checked: 10 November 2026.

Go to the steps · All glossary terms

How it works

  1. You connect to a network you do not control, such as public Wi-Fi, and start talking to a service. 13
  2. An attacker in the middle can read or change traffic that is not protected in transit. 12
  3. HTTPS and TLS encrypt that traffic before it leaves the device. A padlock still does not prove the site is the organisation you have in mind, only that the connection to that site is encrypted. 12

Real UK example

The NCSC's 2017 KRACK Wi-Fi guidance tells home users that email, banking and shopping sites already use HTTPS. That encrypts data before it leaves the device. It also says a WPA2-protected private network is more secure than typical public Wi-Fi. An attacker exploiting the KRACK flaw would have needed to be physically close. That is a worked example of a Wi-Fi weakness, not a current unpatched emergency. 1

Warning signs

  • You are asked to sign in or pay on public Wi-Fi through a site that is not using HTTPS. 1
  • A page has a padlock, but the address is a lookalike of the organisation you expected. 1
  • A new Wi-Fi network in a public place has a name that looks like the cafe or hotel, but was not confirmed with staff. 1

What to do now

  1. For email, banking and shopping, use HTTPS so the data is encrypted before it leaves the device. 1
  2. Check the address is the organisation you intended, because a padlock can also appear on a lookalike site. 1
  3. Prefer a WPA2 private Wi-Fi network over typical public Wi-Fi when you can. Use a work VPN if your employer requires one. 13

UK reporting and support

  • If you think an account has been taken over, follow the NCSC help for a hacked account. 4
  • For fraud or hacking in England, Wales or Northern Ireland, use Report Fraud. In Scotland, call Police Scotland on 101. 578
  • If money has gone or banking details were shared, call your bank using the number on your card. Or use 159 if your bank participates. 6
  • If someone is in danger, call 999. 78

How to protect yourself

  • Use HTTPS for sign-ins and payments, and type or open addresses you already trust. 12
  • Prefer a private Wi-Fi network with WPA2 when you can. 1
  • Follow your employer's VPN instructions when they are required for work systems. The NCSC's detailed VPN guidance is for organisations, not individuals. 3

Frequently asked questions

Can someone on cafe Wi-Fi see my bank login?

The NCSC tells home users that banking sites use HTTPS to encrypt data before it leaves the device. A padlock does not prove the site is your bank, only that the connection to that address is encrypted. A WPA2 private network is more secure than typical public Wi-Fi. 1

Should I never use public Wi-Fi?

The NCSC does not say that. It says a WPA2 private network is more secure than typical public Wi-Fi. HTTPS already protects email, banking and shopping traffic as it leaves the device. 1

Is the 2017 KRACK flaw still an emergency?

This page uses KRACK only as a worked example from NCSC guidance. An attacker exploiting that flaw would have needed to be physically close. It should not be read as a current unpatched emergency. 1

Matching kit

Account Lockdown Kit · £19 · Digital download.

A self-serve guide to securing email, phone and online accounts. It does not promise to stop every attack.

General information, not legal, financial or personalised security advice. Secordit is not a police or bank reporting service.

News Pulse

Account security, explained by email.

Read about News Pulse

Sources

  1. NCSC, 'Krack' Wi-Fi guidance | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  2. NCSC, Using TLS to protect data | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  3. NCSC, Virtual Private Networks (VPNs) | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  4. NCSC, Help for individuals | National Cyber Security Centre. Accessed 10 November 2026 (Europe/London).
  5. Report Fraud, Report Fraud. Accessed 10 November 2026 (Europe/London).
  6. Stop Scams UK, 159 Phone number - Stop Scams UK. Accessed 10 November 2026 (Europe/London).
  7. Police Scotland, How to report a crime - Police Scotland. Accessed 10 November 2026 (Europe/London).
  8. Report Fraud, Reporting cyber crime and fraud or phishing attempts - Report Fraud. Accessed 10 November 2026 (Europe/London).