Who this guide is for
You bank or shop on public or hotel Wi-Fi and want to know what the network can still learn beyond what HTTPS protects.
Who it’s not for
A VPN won’t protect you from phishing, a scam phone call, a breach at a retailer or malware already on your device. Two-factor authentication and your card issuer’s alerts still do that work.
In short
- HTTPS already encrypts your password, balance and card details. It doesn’t hide which bank or shop you visit, or when.
- A VPN hides those destinations from the network and covers apps that don’t encrypt properly.
- Banks watch for sign-ins from unexpected places. Choose a server in your own country, or use split tunnelling (not on iPhone, iPad or Mac) to keep the banking app outside the tunnel.
- A VPN won’t stop phishing, scams or card fraud. Two-factor authentication and a careful eye still do that work.
On this page
You check your balance while the coffee cools. You buy something from a hotel room over the guest Wi-Fi. The site itself is almost certainly encrypted — banks and mainstream retailers use HTTPS, and that padlock is doing real work — but the network carrying it is not yours, and it still learns a great deal about you. DarkMatter puts an encrypted tunnel between your device and the internet, so the hotspot sees one connection to a VPN server instead of a map of where your money goes.
Why people use a VPN for banking and shopping
- HTTPS hides the contents, not the destination. Your password and card number are already encrypted in transit. The domain names you connect to, the timing and the rough size of each request are not. Whoever runs the network can build a list: your bank, your card provider, the shops you buy from and the times you check your balance.
- A hotspot is not always what its name says. Anyone can stand up a network called after the café next door. Inside a VPN tunnel, a rogue hotspot carries traffic it cannot read, which leaves it far less to work with.
- Not everything on your device speaks HTTPS. Background services, older apps, captive portals and assorted chatter are mixed in with your browsing. A VPN encrypts everything routed through the tunnel, whatever each app does or fails to do on its own.
- Location is a pricing and profiling signal. Retailers, travel sites and comparison engines sometimes vary prices, offers and product ranges by region, and your IP address is one of the inputs. A VPN changes that one input, which is not the same as changing the outcome.
- Your provider keeps its own records. At home, your internet provider can see the domains you resolve and connect to. Through a tunnel, it sees an encrypted connection to a VPN server instead.
How DarkMatter helps
When you connect, DarkMatter builds an encrypted tunnel from your device to a VPN server on our network. Everything your device sends through it travels inside that tunnel, so the café, the airport or the hotel carries traffic it cannot read or attribute to a particular site, and the shop at the far end sees the server’s address rather than the one your provider gave you.
- AES-256 encryption wraps the traffic in the tunnel, including traffic that HTTPS was not protecting.
- WireGuard is the default protocol, with OpenVPN, IKEv2 and IPSec available too.
- A kill switch in our Windows app is designed to block traffic if the tunnel drops. Mid-payment on a flaky hotspot is precisely when you do not want your device quietly falling back to the open network.
- DNS and IPv6 leak protection are designed to keep name lookups inside the tunnel, so the network operator does not collect the list of destinations by the back door.
- Split tunnelling (not on iPhone, iPad or Mac) lets you choose which apps use the tunnel, which helps if one particular banking app objects to the connection.
- 6,000+ servers across 65+ countries and 80+ locations, each with a 20 Gbps connection, so you can usually pick a server in your own country while you are out and about. Browse them on Server Locations.
| On a shared network | Without a VPN | With DarkMatter |
|---|---|---|
| Contents of an HTTPS page | Already encrypted | Encrypted, inside the tunnel |
| Which bank or shop you visit | Visible to the network | Hidden in the tunnel |
| DNS lookups | Go to the network’s resolver | Designed to stay inside the tunnel |
| Traffic from apps not using HTTPS | Readable in transit | Encrypted |
| IP address the retailer sees | Yours | The VPN server’s |
Every feature on every plan
Encrypt your connection on up to 5 devices at once
- Apps for Windows, macOS, iOS, Android and Fire TV
- Kill switch (Windows app)
- Split tunnelling (not on iPhone, iPad or Mac)
- DNS and IPv6 leak protection
- 30-day money-back guarantee on your first purchase (14 days on monthly plans)
The honest bit
An honest note on banks, blocks and fraud
Banks and card issuers watch for sign-ins from unexpected places, and a VPN deliberately changes where you appear to be. Connecting through a server in another country can trigger an extra verification step, a declined payment or, now and then, a temporary hold while the bank confirms it is really you. That is the fraud system working as intended. The remedy is usually simple — pick a server in your own country before you sign in, or keep the banking app outside the tunnel with split tunnelling (not on iPhone, iPad or Mac) — but we cannot promise that any particular bank, card issuer or retailer will accept a VPN connection, and some say in their terms that they would rather you did not use one.
A VPN also has nothing to say about fraud or phishing. It protects the path your data takes; it does not judge the destination. If you follow a link from a convincing text message and type your details into a lookalike site, the tunnel will carry them there faithfully. It will not stop a scam phone call, a breach at a retailer you trusted, malware already on your device, or a card cloned at a petrol pump. Keep two-factor authentication switched on, read the domain in the address bar yourself, turn on your card issuer’s alerts, and treat unexpected messages about your account with suspicion. A VPN is one layer among several, not a replacement for the rest. If it turns out not to be the right layer for you, the money-back guarantee on your first purchase applies (30 days, or 14 days on monthly plans).