"Protect yourself from hackers" is one of the most common lines in VPN advertising. It is half true. A VPN is very good at one specific job, and useless against several of the attacks that actually cause most account takeovers. Here is the honest breakdown.
What a VPN does
A VPN encrypts the connection between your device and the VPN server. Anyone between those two points, on the same Wi-Fi network, at your ISP, or operating the hotspot, cannot read your traffic or see which sites you visit.
So the question is really: which attacks happen on that stretch of the path?
Attacks a VPN helps with
Snooping on public Wi-Fi. On an open or shared network, other users and the operator may be able to observe traffic. With a VPN, they see only an encrypted connection to the VPN server.
Evil-twin hotspots. An attacker sets up a Wi-Fi network named like the café's or hotel's. If you connect, your traffic flows through their equipment. A VPN means that equipment sees only encrypted data going to the VPN.
Traffic redirection on hostile networks. On a compromised network, an attacker may try to redirect DNS lookups to fake sites. A VPN that routes DNS through the tunnel removes the local network from that process.
ISP-level tracking. Your provider can no longer log which sites you visit.
Attacks a VPN does not help with
Phishing. If you type your password into a fake login page, the VPN faithfully delivers it, encrypted, to the attacker. Phishing is the most common way accounts are stolen, and a VPN does nothing about it.
Malware. Infected downloads, malicious browser extensions and dodgy apps run on your device, inside the tunnel. A VPN does not scan or block them.
Reused and leaked passwords. If your password leaked from another site, attackers try it everywhere. That happens on the service's servers, not your network.
SIM swapping and account recovery scams. Attackers talk your carrier into moving your number, then reset accounts by SMS. Entirely outside a VPN's reach.
Social engineering. Fake support calls, fake invoices, urgent messages from "your boss". No network tool helps here.
What to pair a VPN with
A VPN is one layer. The layers that stop the attacks above:
- A password manager, so every account has a unique password and fake sites do not autofill.
- Multi-factor authentication, preferably an app or security key rather than SMS.
- Updates, for your phone, laptop, browser and apps.
- Care with links and attachments, especially in "urgent" messages.
- A carrier PIN to make SIM swapping harder.
So, do you need a VPN for security?
If you regularly use networks you do not control, such as cafés, hotels, airports, co-working spaces and conference Wi-Fi, a VPN removes a whole category of risk: the network itself. That is worth having.
If your worry is account takeovers, start with a password manager and MFA. They protect against the attacks that happen most often.
Choosing a VPN for security
- A specific no-logs policy, because the provider takes over your ISP's view of your traffic.
- DNS through the tunnel, with a leak test to confirm it.
- A kill switch, so nothing leaks if the connection drops.
- A real company with contact details.
Korp VPN routes DNS through the tunnel, includes DNS and WebRTC leak tests in the app, runs a strict no-logs policy on RAM-only servers and has a stealth protocol for restrictive networks. Plans are $4.99 for three months or $17.99 a year.