Evil Twin Wi-Fi: How to Spot a Fake Hotspot

Short answer

An evil twin is a fake Wi-Fi hotspot that copies the name of a real one, so your phone joins it instead. Whoever runs it sees which sites you visit, can tamper with unencrypted traffic and can show a fake login page. Ask staff for the exact network name, never type passwords or card numbers into a Wi-Fi login page, and use mobile data or a VPN on public networks.

You sit down in a café, open your Wi-Fi list and see Cafe_WiFi. You tap it, maybe accept a login page, and you're online. What you can't see is whether that network belongs to the café, or to someone at the next table with a laptop and a cheap wireless adapter.

That second network is an evil twin: a fake hotspot that copies a real network's name. It's an old trick, and it still works because of how Wi-Fi decides which network to trust.

Why phones fall for a copied name

Wi-Fi networks are identified by name. On an open network, nothing proves that the hotspot called Cafe_WiFi is the café's. Anyone can broadcast any name.
Phones rejoin names they know. If you've used Airport_Free_WiFi before, your phone may join any network with that name, anywhere, without asking.
The stronger signal usually wins. A twin placed closer to you than the real router looks like the better choice.
A password on the wall doesn't help. If every customer knows the password, so does the attacker, who can set up a twin with the same name and the same password.

What a fake hotspot can see and do

Whoever runs a hotspot, fake or real, sits between you and the internet. On a fake one, that person is hostile.

What they can do	How	What stops it
See which sites and apps you use	Plain DNS lookups and the site names in encrypted connections	Encrypted DNS or a VPN
Change where you end up	Rewriting DNS answers, tampering with pages that don't use HTTPS	HTTPS with no ignored warnings; a VPN with its own DNS
Ask for your details	A fake login page asking for your email password, a social login or a card number	Never typing those into a Wi-Fi login page
Read the content of HTTPS pages	Not possible, unless you click through a certificate warning	Treating every certificate warning as a stop sign

Diagram: without a VPN, a phone's traffic passes through a fake hotspot that copies the café's name and can read site names, rewrite DNS and show a fake login page; with a VPN, the same hotspot only carries one encrypted connection to the VPN server — What an evil twin can do, without and with a VPN

The table shows the good news too. Most of what you do today runs over HTTPS, which the US Federal Trade Commission says makes public Wi-Fi "usually safe" for the content itself. Many sites also use HSTS (RFC 6797), which tells your browser to refuse insecure connections to them and not to let you click past certificate errors. An evil twin's real power is in what's left: the list of places you visit, sites without HTTPS, and whatever you type into its pages. Our article on what the Wi-Fi owner can see goes through that list in detail, and the What your network sees tool shows it on your own connection.

Warning signs

None of these proves an attack, but each is a reason to stop and check:

Two networks with the same name, one open and one with a lock, or the same name appearing twice with different signal strengths.
A login page that asks for too much: your email or social media password, a card number for "free" Wi-Fi, or an app or profile to install.
A certificate warning in your browser on a site that normally works. Leave; don't click through.
A name that's almost right: Airport-WiFi-Free when the official one is Airport Free WiFi.
Sites looking slightly off, or a sign-in page for your bank at an address you don't recognize.

How to protect yourself, step by step

Ask staff for the exact network name, and whether it has a password. Signs and receipts help too.
Stop auto-joining open networks. On Android, open Settings › Network & internet › Internet, tap the gear next to a saved public network and turn off Auto-connect, or tap Forget after your trip.
Never type account passwords or card numbers into a Wi-Fi login page. A legitimate café or hotel page asks you to accept terms, or for a room number or a code on your receipt.
Treat certificate warnings as a stop sign. They're often the only visible sign that someone is in the middle.
Use mobile data for sensitive things like banking or changing passwords, when you can.
Use a VPN that connects on its own on networks you don't trust, with Android's kill switch on so nothing leaks while it connects. Our guide to the Android kill switch shows how.

What a VPN does, and doesn't do, against an evil twin

It does:

Encrypt everything between your phone and the VPN server, so the twin sees one encrypted connection instead of your sites.
Answer DNS lookups inside the tunnel, so the twin can't send you to fake addresses.
Refuse to talk to impostors. WireGuard only completes a handshake with a server whose public key the app already knows, so a fake hotspot can't pretend to be the VPN server.

It doesn't:

Protect you before it connects. A fake login page appears first, and a VPN can't stop you typing into it.
Stop phishing. If you enter your password on a fake site, encryption doesn't help.
Fix a phone that's already infected.

What about WPA3 and "secure" networks?

The newer Wi-Fi security standards help, within limits. According to the Wi-Fi Alliance, WPA3-Personal gives "increased protections from password guessing attempts", and Wi-Fi Enhanced Open adds encryption to open networks. Neither proves who runs the hotspot when the password is public or there's no password at all. Enterprise networks that use individual logins can prove their identity, but only if your phone is set to check the network's certificate.

How PryVPN helps on public Wi-Fi

Auto-connect on untrusted Wi-Fi. In Settings › Auto-connect and Wi-Fi, turn on On untrusted Wi-Fi, and PryVPN connects on every network you haven't marked as trusted. The public Wi-Fi help article has the details.
Login pages handled on purpose. PryVPN detects the network's login page and asks you to sign in first, instead of failing silently (Wi-Fi login pages). That's also your moment to check the page is asking only for what a café would ask.
DNS inside the tunnel. Lookups go to the resolver on our server, which answers from memory and doesn't log them.

Frequently asked questions

Can an evil twin steal my passwords?

Only if you give them away: by typing them into its pages, ignoring a certificate warning, or using a site without HTTPS. With HTTPS and a VPN, it sees encrypted data it can't read.

Is a password-protected café Wi-Fi safe from evil twins?

Not really. If the password is printed on the menu, an attacker can use it too. The password stops strangers joining; it doesn't prove which hotspot is the real one.

Does HTTPS protect me on a fake hotspot?

It protects the content of the page, as long as you never click through a certificate warning. It doesn't hide which sites you visit, and it can't stop you typing into a fake login page.

Should I just avoid public Wi-Fi?

For sensitive tasks, mobile data is the simplest choice. For everyday browsing, public Wi-Fi with HTTPS and a VPN is fine. Our guide to whether public Wi-Fi is safe goes further.

If you'd like a VPN that switches itself on when you join a network you don't trust, you can join the PryVPN beta.

Sources

Spotted a mistake? Write to support@pryvpn.com and we'll fix it and update the date.