The name on the card can be copied
The room card lists a network name and a password. Anyone can advertise that same name from a phone or a small router. If two names match, the phone may join the one with the stronger signal, which can be the one in the next seat at the lobby. Ask the front desk which name is theirs if you see duplicates, and forget the network when you check out so the phone does not rejoin a copy later.
The login page that appears after you connect is a captive portal. Give it the room number or the email it asks for so the network will let you out. Do not type a bank password, an email password, or a card number into that page. If the portal asks for any of those, close it and use mobile data.
Order of operations
Connect to wifi, finish the portal, then open the VPN app and wait until it says connected. Pages you load before that still cross the hotel network in the ordinary way. HTTPS already encrypts most sites between your browser and the site. The VPN changes what the hotel network can see: a connection to the VPN company, rather than the list of sites inside the tunnel.
A VPN will not tell you that you joined the real hotel network. It will not catch a lookalike bank address. Read the address before you type a password. And it will not stop roaming charges if cellular data is still roaming on the home SIM. That switch is covered on Roaming and bill shock.
When the hotel blocks the VPN
Some networks block VPN servers. If the app sits on "connecting", try another server inside the app, or use mobile data for the thing you were about to sign in to. Do not install a random "wifi helper" because a popup suggested it.
The longer account of what a VPN does and does not do is Wifi and VPN.