How to tell if a Wi-Fi hotspot is fake

A fake hotspot, often called an evil twin, is a Wi-Fi network someone set up to look like the real one. You usually cannot spot it from the name, because copying the name is the whole trick. You can spot it by checking the name against what the venue posts, by refusing any login page that asks for a password or card number, and by taking your phone’s warnings seriously. Here is how the attack works, the signs, the phone settings that help, and what to do if you already connected.

What an evil twin is

CISA describes it this way: an attacker copies a legitimate hotspot and broadcasts a stronger signal, so your device connects to the attacker instead. “The adversary uses a broadcast signal stronger than the one generated by the legitimate access point.” Anything you then send without encryption can be read.

Kaspersky’s write-up fills in the steps. The attacker picks a busy place with free Wi-Fi, creates a network with the same name, and moves close enough that the fake has “a stronger connection signal than the legitimate versions.” Then comes the part that does the damage: a copy of the venue’s login page. “Evil twin hackers set up a copy of this page” to collect whatever you type.

This is not theoretical. In June 2024, the Australian Federal Police charged a man who allegedly ran fake free Wi-Fi at airports in Perth, Melbourne and Adelaide, and on domestic flights. People who joined were sent to a page asking them to “sign in using their email or social media logins.” The AFP said those credentials could unlock “a victim’s online communications,” stored photos and videos, or bank details. An airline employee noticed a suspicious network on a flight, which is how the case started.

What a fake hotspot can and cannot see

Most of what you do is encrypted before it leaves your phone. The FTC says most websites now use encryption, and the EFF notes that HTTPS “protects the content of your communications, but not the metadata.” A fake network sees which domains you visit, not what you do there. That is why modern evil twins lean on the fake login page. The FTC’s warning fits: a scam page can use encryption too, and “your data may be encrypted on its way to the site, but it won’t be safe from scammers operating the site.” The attacker does not need to break encryption. He needs you to type.

The signs

A name that is close but not exact

“Airport_Free_WiFi” next to “Airport Free WiFi.” Kaspersky notes that busy venues often run several access points under one name, so seeing the same name twice is not by itself a sign. A name that differs from the posted one is. CISA’s rule: “Always confirm the name and password of a public Wi-Fi hotspot prior to use.”

No password where you expected one

If the venue’s sign gives a password and a network with that name connects without asking, be suspicious. Kaspersky says evil twin networks “nearly always” show as unsecured. On Android, Google’s help page says a lock icon next to the network means it is password-protected. The Wi-Fi Alliance describes Wi-Fi Enhanced Open, which encrypts traffic on open networks without a password, but that does not verify who runs the network. An encrypted link does not mean an honest owner.

A login page that asks for too much

Real captive portals exist. Apple’s page on captive networks says a legitimate login screen may ask for a username and password for that hotspot service, an email address, or acceptance of terms. What a real portal does not need is your Google, Apple, Facebook, or bank password, or a card number for “free” Wi-Fi. The AFP’s advice: “you shouldn’t have to enter any personal details.” If the page looks like a social media or email sign-in, close it.

A certificate or “not private” warning

If your browser throws a full-page warning right after you join a new network, stop. Chrome’s help page says “Your connection is not private” means a problem with the site, the network, or your device. On a network you just joined, the network is the likely suspect. Kaspersky’s advice: “your device is trying to protect you from danger,” so do not dismiss it. Apple says a privacy or security warning next to a network name means the network “could expose information about your device,” or uses weak security.

Check with staff or the signage

This is the step that works. Ask at the counter or front desk for the exact network name and password, or find the posted sign, table card, or key-card sleeve. Compare it character by character with what your phone shows. If the venue says there is a password and the network you see has none, do not join. If a login page asks for your email provider’s password, do not type it.

CISA recommends WPA2 at minimum and WPA3 where available. A venue that hands out a password gives you one more thing to match.

iPhone settings that help

Apple does some of this for you. Apple’s auto-join page says “An open (unsecured) wireless network that wasn’t manually joined in the past 2 weeks isn’t auto-joined.” An old open network will not silently pull your phone back in.

Private Wi-Fi Address is on by default on iOS 14 and later. Apple’s page says the phone “identifies itself to each network using a different Wi-Fi address,” so a network operator cannot track your hardware address across locations. On iOS 18 and later: Settings, Wi-Fi, tap the More Info button next to a network, tap Private Wi-Fi Address, and choose Fixed or Rotating. Rotating changes the address “every 2 weeks” and is the default for networks with weak or no security.

To stop rejoining a network, Apple’s steps are: Settings, Wi-Fi, Edit, tap the More Info button next to the network, then turn off Auto-Join. To remove it, tap Forget This Network, then Forget. With iCloud Keychain on, forgetting a network on one device makes your other devices forget it too.

If a captive login page appears and you do not like what it asks, Apple says tapping Cancel disconnects you.

Android settings that help

Google’s help page says that when a saved network is nearby and Wi-Fi is on, “your device automatically connects to this network.” To forget one: Settings, Network & internet, Internet, touch and hold the network, tap Forget.

The auto-join controls live under Settings, Network & internet, Internet, Network preferences. Google’s Pixel page lists “Connect to open networks,” which will “Automatically connect to high-quality open networks.” Turn it off. Google notes the options “vary by device and Android version,” so labels may differ on a Samsung or Motorola.

Randomized MAC addresses are on by default on Android 10 and later, per Android’s documentation. The Pixel page says you can check it per network under “Randomized MAC address.” Leave it on.

If you already connected

• Disconnect and forget the network. The AFP recommends setting your device to “forget network” when you are done, and turning Wi-Fi off before going out if you do not need it.
• If you typed a password into a login page, change it now, and anywhere you reused it. The AFP and Kaspersky both put this first.
• If you entered a card number, Kaspersky says to contact your bank right away. The FTC says that if a bank account or card number was exposed, go to IdentityTheft.gov for steps specific to what you lost.
• If you think a link or attachment put harmful software on your device, the FTC says to “update your computer’s security software. Then run a scan and remove anything it identifies as a problem.”
• Watch your accounts and report the attempt at ReportFraud.ftc.gov.

If you were banking at the time, read is online banking safe on public Wi-Fi for what the app’s encryption did and did not cover.

Quick checklist

Before you join:

• Get the exact network name from staff or a sign.
• Match it character by character.
• Expect a password if the venue says there is one.

On the login page:

• Email or “accept terms” is normal.
• An account password or card number is not. Close it.

While connected:

• Do not click through certificate warnings.
• Use a VPN if you want to hide which sites you visit. See the best VPN for public Wi-Fi and whether free VPNs are safe.
• Use mobile data for anything sensitive. If data is tight, see our plans guide.

Afterward:

• Forget the network.
• Turn off auto-connect to open networks.

Venue guides: airport Wi-Fi, hotel Wi-Fi, and the Wi-Fi safety hub.