In short: An evil twin is a fake Wi-Fi hotspot that an attacker gives the same name as a real network in a cafe, airport or hotel. Devices connect to the clone, and all unencrypted traffic flows through the attacker's gear: they can read data, redirect you to fake sites and show phony login pages. You usually cannot tell a twin apart by sight, so treat every open network as untrusted. The core defense is simple: turn off auto-connect, never enter data on pop-up sign-in pages, and keep a VPN switched on so it encrypts everything into a tunnel — then the fake hotspot only sees unreadable traffic.
What an evil twin attack is
The name is literal: an attacker sets up their own access point and gives it the SSID of a network that already exists — say, the guest Wi-Fi of a coffee shop or airport. To your phone or laptop it looks like the same network you have joined before. The name is identical, and the twin often broadcasts a stronger signal, so the device picks it instead.
The key difference from a classic hack is that the attacker does not need to break the venue's router encryption. They simply become the middleman: your traffic goes not to the real router but through the attacker's laptop or pocket device, which then passes the internet along. This is a form of man-in-the-middle attack — we covered how it works in the piece on MITM attacks.
The danger is how accessible it is: the tools to run a fake hotspot no longer require deep skills, and the hardware fits in a pocket. So you can meet a twin in any crowded place with free Wi-Fi, which means the smart bet is on your own defenses rather than on the attack being rare.
How a fake hotspot is created
Cloning the network name (SSID)
Wi-Fi devices recognize networks by name (SSID), not by the identity of a specific router. If a second access point with the same name appears nearby, your phone treats it as the same network. The attacker only needs to copy the public Wi-Fi name — no venue password required, since the name is visible to everyone around.
A stronger signal and auto-connect
Phones join known networks automatically by default and prefer the access point with the stronger signal. The attacker places their device closer to people or boosts the signal, and the phone switches to the twin on its own, often without a single tap. That is why auto-connect to open networks is the first thing to disable.
Forced disconnects (deauth)
To speed things up, the attacker can send devices management frames that drop the connection (deauthentication). The real network falls away for a few seconds, the device looks for a replacement, and finds the twin with the same name. At best the user notices a brief hiccup and thinks nothing of it.
A fake sign-in page (captive portal)
Public networks often open a page with a Connect button or a form: phone number, email, or a social sign-in. The twin shows the same page, but whatever you enter goes to the attacker. This is how passwords, numbers and payment details are stolen, with an important caveat: a VPN will not help if you type your data into a fake form yourself. We return to those limits below.
What the attacker can see and alter
Once your traffic passes through the attacker's gear, they become your gateway to the internet. That gives them several options:
- read anything sent without encryption — HTTP sites and some app traffic;
- see which sites and services you reach, even when the pages themselves load over HTTPS (host names and DNS queries);
- tamper with DNS answers and send you to look-alike copies of sites instead of the real ones;
- try to downgrade the connection and slip in a page without HTTPS;
- show fake update this app or sign in again prompts to harvest passwords.
Most modern sites run over HTTPS, and that seriously limits the attacker: they cannot read the contents of secured pages. But HTTPS does not cover everything — the metadata about where you go stays visible, and some apps still handle data carelessly. For the full picture of what a connection protects and what it does not, see our breakdown of what a VPN protects against.
Real hotspot or a twin: what to look for
There is no foolproof way to tell a twin apart by sight: the name, and often the sign-in page, are copied exactly. Still, a few signs should put you on guard.
| Sign | Likely the real network | Possible twin |
|---|---|---|
| Duplicates in the list | One network with that name | Two identical networks side by side |
| Security type | Password (WPA) issued by the venue | Open network with no password, though there usually is one |
| Sign-in page | Familiar venue portal | Asks for too much: email password, payment, social login |
| Connection behavior | Steady connection | Sudden drop and reconnect to the same network |
| Site certificate | No browser warnings | Certificate errors, connection not secure |
If your browser warns about a certificate problem, do not click Proceed anyway. On a public network that is a common sign that someone has wedged into the connection.
How a VPN protects you on someone else's Wi-Fi
A VPN solves the core problem of open networks: it encrypts all of your device's traffic and wraps it in a secure tunnel to your VPN server. Even if you connected to the twin itself, its owner sees only a steady stream of encrypted data to a single address — no sites, no passwords, no content. They cannot read or alter what is inside the tunnel.
The encryption is not abstract: modern protocols use strong algorithms. WireGuard, for example, is built on the ChaCha20-Poly1305 cipher, while OpenVPN and IKEv2 typically use AES. Cracking such a tunnel on a public hotspot is not realistic. A VPN also carries DNS queries inside the tunnel, so a fake hotspot cannot spoof them to send you to a bogus site.
It helps to know the limits. A VPN encrypts the channel, but it does not think for you. If you type a password into a fake captive-portal form, or install an internet access certificate that a suspicious network asks for, that happens outside the tunnel. A VPN and your own attention only work together — for the underlying principles, see our guide to public Wi-Fi security.
For the tunnel to have somewhere to go, you need a reliable service with servers in many countries and no logs. You can view the LiMP VPN server map and pick the nearest one on a dedicated page: the closer the server, the smaller the speed drop.
Where the risk of a twin is highest
Fake hotspots are set up most often where crowds carry phones and free Wi-Fi is expected: airports and stations, cafes and food courts, hotels and rentals, malls, conferences and coworking spaces. Travel raises the risk further — you do not know what the local network is supposed to be called, so a twin passes for the official one more easily. Advice tailored to frequent travelers is gathered in our article on VPN for travel.
At home the risk is lower but not zero: if your router is open or protected by a weak password, someone nearby can spin up a twin of your home network too. The basic settings that make this harder are covered in the guide to secure router settings.
Checklist: connecting safely to public Wi-Fi
- Turn off auto-connect to open and known networks in the Wi-Fi settings of your phone and laptop.
- Confirm the exact network name with venue staff and choose only that one, not a look-alike.
- Switch the VPN on before you open email, banking or social apps, not after.
- Do not enter passwords, codes or payment details on pages that open by themselves when you connect.
- Ignore requests to install a profile, certificate or app for internet access.
- Do not dismiss browser certificate warnings, and do not open sites that trigger them.
- Keep two-factor authentication on important accounts — a stolen password is useless without the second factor.
- When you are done, tell the device to forget the network so it does not auto-join next time.
If you already connected to a suspicious network
- Turn Wi-Fi off immediately and switch to mobile data.
- Do not open banking apps or enter passwords until you change networks.
- If you signed in somewhere, change those account passwords from a trusted connection and review active sessions.
- Check whether an extra profile or certificate was installed, and remove it.
- Turn on bank transaction alerts and watch your account over the next few days.
Frequently asked questions
Does HTTPS protect me from a fake Wi-Fi hotspot?
HTTPS encrypts page contents, so an attacker cannot read your password on a normal site. But they can see which sites you reach and may try to downgrade the connection or show a look-alike copy. HTTPS is the necessary minimum, not full protection; a VPN also covers metadata and DNS queries.
Can a VPN tell that I connected to a twin?
No, a VPN does not judge whether a network is real or fake. It does something else: it encrypts your traffic so it is useless to the owner of the fake hotspot. Spotting the network is still on your side — using signs like duplicates in the list and certificate errors.
Does mobile data help instead of Wi-Fi?
Yes, a cellular network is not exposed to an evil twin: there is no rogue middle point to join by mistake. If you are sending something sensitive and doubt the Wi-Fi, switch to mobile data.
Are networks with a password written on the cafe wall dangerous?
A shared password keeps out random connections but not a twin: the attacker knows that password too and can raise a network with the same name. A password on the wall does not confirm the hotspot is genuine.
How do I tell a real captive portal from a fake one?
A genuine portal usually just asks you to accept terms or enter a number for an SMS code. If the page demands your email password, a payment or a social login, that is a warning sign. When in doubt, enter nothing and ask staff.
Does incognito mode save me from this attack?
No. Incognito only avoids saving history on your device and does not encrypt network traffic at all. It offers no protection against interception on a fake hotspot — you need a VPN for that.