HTTPS is mostly secure. However running over a public wifi hotspot is risky, and if your device is configured to allow auto proxy discovery then you are at risk for a couple of fairly new key discovery techniques that can expose your login information and traffic. A lot depends on how good your bank security folks are and how trustworthy the WIFI operators is.
Password protected WIFI does nothing to protect user data, it's strictly a means of access control.
There are several options that can help assure your security, SSH tunnel to a known safe server, good VPN service, TOR. However all of these require proper configuration and good security practices on your end.
I would recommend paying bills on AT&T and only using public WIFI for browsing, email, things that IF someone was able to access it wouldn't mean an empty bank account. AT&T should have their 'stuff' together, and the risk of rogue proxy or MITM attacks should be minimal.