The biggest risk is random mobile apps that disable HTTPS certificate checking, run APIs over plain HTTP, etc. On public Wi-Fi, anyone physically near you can i

The biggest risk is random mobile apps that disable HTTPS certificate checking, run APIs over plain HTTP, etc. On public Wi-Fi, anyone physically near you can intercept or snoop on that traffic. Browsers generally do a good job of ensuring HTTPS these days, but still you should pay attention to make sure you're on HTTPS when using public Wi-Fi.