Americans Spent $577 Billion Shopping on Their Phones Last Year. 68% Did It Without Any Encryption.

In 2025, US mobile commerce hit $577.6 billion. That’s your bank apps, shopping carts, stored credit cards, two-factor authentication messages, private messages, medical data, all streaming through your phone onto the Wi-Fi network at your local coffee shop, at the airport, at the hotel, at any network your phone connects to when you step into a mall.

A survey by Security.org asked more than 1,000 US adults about VPNs, and found that 68% don’t use them or haven’t heard of them. An AllAboutCookies survey found 37% have never used a VPN, and a further 24% who used to, but don’t anymore.

That means the majority of the $577.6 billion in mobile transactions last year moved across networks with zero additional encryption beyond whatever the app itself provides. For context, IBM’s 2024 Cost of a Data Breach report measured the average US data breach at $9.36 million — the highest of any country, 2025 is also live.

How Much Money Flows Through US Phones Each Year

That $577.6 billion is just retail. It doesn’t include mobile banking, investment apps, insurance portals, crypto wallets, or peer-to-peer payments through Venmo, Zelle, and Cash App. Add those in and the volume of sensitive financial data passing through American smartphones annually is well past a trillion dollars.

84% of VPN Users Say Public Wi-Fi Security Is Why They Have One

The people who do use VPNs already understand the risk, now in this sense, the concpet of the VPN safe internet access from anywhere. AllAboutCookies found that 84% of VPN users specifically cite increased security on public Wi-Fi as their primary reason. Another 83% use them for general internet safety. These aren’t corporate policy requirements — the top reasons are personal.

Yet adoption dropped in 2025. Security.org’s annual consumer report showed US VPN usage fell from 46% in 2024 to 32% in 2025. The leading barrier? “I don’t need one” — 52% of non-users said exactly that.

Meanwhile, the cybersecurity threat picture is moving in the opposite direction.

The Threat Data Doesn’t Match the Behavior

$639.2 billion in cybercrime costs on one side. 68% of the population browsing unprotected on the other. Those two numbers sitting next to each other should be uncomfortable.

For smartphone users, the phishing stat is the most relevant. 80% to 95% of attacks start with a social engineering attack – a spoofed page, a spoofed email, a bad link on a public network. Generative AI makes these attacks much more dangerous. VikingCloud’s 2025 research revealed that more than 80% of social engineering is now done with AI-driven phishing. The emails and websites no longer look like fakes. They’re created on the fly, filled with data stolen from other sites, and crafted to get past the sort of “look and feel” test most of us use.

On an open Wi-Fi network, someone between you and the wireless router can eavesdrop on traffic. Your login, tokens, passwords, credit card details – anything the app doesn’t already encrypt individually – is laid bare. With a VPN, all traffic leaving your phone is encrypted, so even if it’s intercepted, it cannot be read. The data on security breaches from IBM supports the difference: companies with extensive use of security automation and encryption suffered an average of US$3.84 million per breach – almost US$2 million less than other companies.

It takes just a few minutes to set up on iOS or Android. Once configured, it operates transparently and doesn’t impact performance or battery life on today’s smartphones.

The Mobile Security Gap Isn’t Closing

With all the money phone companies have put into mobile security – fingerprint and facial recognition, secure enclaves, sandboxing. That’s good and valuable. What they don’t do is secure the network connection. Your fingerprint unlocks your phone. Your face unlocks you bank app. All that can’t help if the network that transmits your data from the phone to the server is insecure.

And Americans are spending more time on their phones. In 2015, 5.3 trillion hours were spent using mobile apps around the world (Sensor Tower). Backlinko estimates that Americans spend an average of 5 hours and 16 minutes per day on their phone. Nearly all of that (94%) time comes from spending time in apps, not web browsers, Sensor Tower says.

VeePN is just one example of how digital security tools have become essential for both consumers and businesses navigating an increasingly hostile online environment. But beyond cybersecurity, a deeper transformation is underway. 

What’s Coming Through Your Phone vs What’s Protected

The third column is the gap. Most major apps use HTTPS, which encrypts data between the app and its own servers. That helps. But HTTPS doesn’t hide which services you’re connecting to, doesn’t protect DNS queries on many networks, and doesn’t cover every app equally — especially smaller services, IoT connections, or apps with poor security implementation. A VPN encrypts everything leaving the device regardless of what app generated it.

Who’s Using VPNs and Who Isn’t

The spread is telling. The 2015 Security.org data shows VPN use is much more prevalent in the 18-29 year old age group (nearly 40%) than in other groups. And family income is a strong factor – the higher the income, the greater the adoption rate.

Among VPN users, 52% are iOS users and 37% Android. Mobile users are also more likely to be using their VPN every day (32%) than desktop users (29%) – again, because mobile devices are used on more networks than a home laptop.

Those most likely to be shopping, banking and logging into accounts over public Wi-Fi – young, mobile users – are more likely to be protected. Those who are most vulnerable are also the least likely to have it.

FAQ

Sources: Capital One Shopping/eMarketer (Mobile Commerce Data), Sensor Tower (App Usage), Adobe Analytics (Holiday Mobile Sales), Security.org 2025 VPN Consumer Report, AllAboutCookies 2025 VPN Usage Survey, IBM Cost of a Data Breach Report 2024, SentinelOne Cyber Security Statistics 2026, Cybersecurity Ventures, Sophos State of Ransomware 2024, Javelin Strategy & Research 2025 Identity Fraud Study, Comcast Business Cybersecurity Threat Report, VikingCloud 2025 Cyber Threat Landscape Study, Backlinko, US Census Bureau