What Is an Evil Twin Wi-Fi Hotspot? How to Spot a Fake Network

An evil twin is a fake Wi-Fi network set up to look exactly like a real one, with the same name as the cafe, hotel or airport network, so that your phone joins it instead. Once you are on it, the person running the fake network sits between you and the internet and can watch or change traffic that is not encrypted.

Checked on 8 November 2026.

How does an evil twin Wi-Fi attack work?

An evil twin attack works because phones join networks by name. Anyone with a laptop or a small travel router can create a hotspot called "Airport_Free_WiFi" or "Hotel Guest". If the fake signal is stronger than the real one, phones nearby may pick it, and phones that joined a network with that name before may join it again by themselves. The fake network then passes your traffic on to the real internet, so everything seems normal while it is being watched.

What can an attacker see on a fake Wi-Fi network?

On a fake Wi-Fi network an attacker can see which websites you visit and anything sent without encryption. Most websites use HTTPS today, which hides the content of the page, but the attacker can still try other tricks: a fake login page that asks for your email password, a page that asks you to "install a profile" to get online, or a prompt to download an app. The danger is less about breaking encryption and more about tricking you into typing something on their page.

What are the warning signs of an evil twin?

The warning signs are small, so look for them before you type anything:

Two networks with the same or almost the same name, such as "Cafe WiFi" and "Cafe_WiFi".

An open network with no password where the real one normally has a password.

iPhone shows Weak Security under the network name in Settings > Wi-Fi.

A login page that asks for your email or social media password, or for card details, just to get online.

A page that asks you to install a profile, certificate or app.

If you see any of these, disconnect and ask staff for the exact network name.

How do you stay safe from evil twin hotspots in 5 steps?

Ask for the exact name. Check the network name and password with staff, or on a sign at the counter, before you join.

Turn off Auto-Join for public networks. In Settings > Wi-Fi, tap the (i) next to the network and switch off Auto-Join, so your iPhone does not rejoin a copy later.

Forget networks you no longer use. In the same screen, tap Forget This Network for old hotel and airport networks.

Never give a password to get online. A real hotspot may ask for a room number or a tick box, never your email or bank password.

Turn on a VPN before you browse. A VPN encrypts everything between your iPhone and the VPN server, so a fake hotspot only sees scrambled data.

Does a VPN protect you on an evil twin network?

Yes, a VPN protects the traffic itself. With a VPN on, the evil twin can see that you are connected to a VPN server, but not which sites you visit or what you send. A VPN does not stop you from typing a password into a fake login page yourself, so step 4 still matters. Use both habits together: check the network, and keep the VPN on.

Frequently asked questions

Is free public Wi-Fi always dangerous?

No. Most public Wi-Fi is run by the business you are in. The risk is that you cannot easily tell a real network from a copy, so treat every public network as untrusted and encrypt your connection.

Can my iPhone join a fake network by itself?

It can, if the fake network uses the name of a network you joined before and Auto-Join is on. Switching off Auto-Join for public networks and forgetting old ones closes that gap.

Is mobile data safer than public Wi-Fi?

Mobile data from your carrier is usually safer than an unknown public hotspot, because nobody nearby can set up a copy of it as easily as a Wi-Fi name.

---

CasperVPN encrypts your internet connection with WireGuard, OpenVPN, IKEv2 and CasperCloak, our own protocol, on iPhone and iPad (Mac app coming). Learn more in Public Wi-Fi risks or Download CasperVPN →