CNET News.com recently published a short article (at the bottom of the page) on "rogue access points" for paid WiFi networks that may be able to hijack your logon and capture your user name, password, and credit card information. The rogue access point presents the user with a spoofed login page, captures the information entered by the user, then redirects the connection to the real access point, according to the story. It's worth noting that the article does not cite a specific, provable case of such a hijacking.
Users can reduce the risk of falling victim to such a scam by manually scanning for access points and picking the appropriate one for the venue, according to CNET.