Evil Twin Wi-Fi: What a Fake Hotspot Can and Cannot See

By NorwegianSpark Editorial · Published August 9, 2026 — written with AI assistance and reviewed by the NorwegianSpark SA editorial team.

A Wi-Fi network has no identity worth the name. It advertises a text label, your phone remembers labels it has liked before, and it reconnects to them automatically without asking. That is the entire foundation of the evil twin attack: a device nearby broadcasts the same name as the café, the hotel or the airport, and some phones prefer it because it is closer or stronger.

The hardware needed to do this is small, cheap and sold openly, because the same hardware has a hundred legitimate uses. So the interesting question is not whether someone can stand up a fake hotspot. It is what they get when you join it.

What they get is much less than it used to be

Ten years ago the answer was "nearly everything", because a large share of the web was unencrypted and a network operator could simply read it. That era is over. The overwhelming majority of web traffic is now encrypted in transit, browsers warn loudly when it is not, and many major sites are on preload lists that stop the browser from ever trying an unencrypted connection in the first place — which closes the downgrade trick that used to make this attack easy.

So a fake hotspot in 2026 generally cannot read the contents of your banking session, your email or your messages. What it can still do is worth knowing:

• See where you go, if not what you do. Even encrypted connections reveal the destination — through DNS lookups, and through the server name your device sends when setting up the connection. A hostile network learns the list of services you use, when, and for how long.
• Correlate you over time. A network sees your device, its behaviour and its return visits. That is a tracking surface even when nothing is readable.
• Interfere. It can block, slow or selectively break connections. That is not theft, but a broken connection is a good way to push someone toward a worse option.
• Run a captive portal. This is the genuinely effective part. The fake network shows a login page — for the hotel, the airline, the conference — and asks for an email and password, or a card number. Nothing is being intercepted here at all. You are simply typing into an attacker's form because it appeared where you expected a form to appear. This is phishing with better staging, and it is why the evil twin remains worth caring about.

Why your device joins in the first place

Two mechanisms do most of the work, and both are conveniences.

Automatic reconnection. Your phone keeps a list of networks it has joined and rejoins them silently. A network advertising a familiar name gets that silent acceptance for free.

Deauthentication. Wi-Fi management frames — the small control messages that attach and detach devices — were historically sent unauthenticated, meaning a nearby device could forge a "disconnect" message that appeared to come from the real access point. Knocking a device off a legitimate network is a reliable way to get it hunting for an alternative.

That specific hole has a fix, and it is a good news story. The 802.11w amendment adds a cryptographic integrity check to those management frames, so forged disconnects are rejected. It was optional under WPA2 and frequently switched off; under WPA3 it is mandatory. This is one of the more concrete reasons to prefer WPA3 on your own network, alongside everything else in the router checklist — though on someone else's network you have no say in the matter, which brings us to the actual answer.

The fix, in order

Turn off automatic joining for open networks. Both major phone platforms let you stop auto-joining networks that have no password, and to forget individual networks. Do this for every hotel and airport network you will never use again. It is the single highest-value setting in this article and it costs nothing.

Use a VPN on any network you do not own. This is the one place in the cheap-hardware series where a product is genuinely the fix rather than a mitigation. A VPN builds an encrypted tunnel from your device to a server you chose, so the local network — hostile or not — sees one connection to one endpoint and nothing else. It cannot read destinations, cannot fingerprint your service list, and cannot usefully interfere with individual connections. The threat model of "the network I am on may be run by someone who is not who they claim" is precisely, and almost uniquely, the one a VPN solves.

Choose on the things that matter — an independently audited no-logs policy, a jurisdiction you can live with, and a track record — not on speed claims. NordVPN, Surfshark and Proton VPN have all been through third-party audits and are the ones we would compare first; our best VPN for privacy piece is the longer comparison and the buying guide covers the features worth paying for. Avoid free VPNs for this job: you are moving your trust from the café to the provider, so a provider whose business model is your data is a lateral move at best.

Do not enter credentials into a captive portal. No legitimate hotel Wi-Fi needs your email password. If a portal asks for an account login or a card number, close it and use mobile data. This is the failure mode a VPN cannot save you from, because you volunteered the information.

Prefer mobile data or your own hotspot when it matters. Tethering to your own phone removes the entire question, and for a short banking session it costs a few megabytes.

Do not ignore certificate warnings. They are rare now, and on an untrusted network a warning is the one signal that something is genuinely wrong.

Where this fits

The short, practical version of this advice lives in is public Wi-Fi safe; this piece is the mechanism behind it. For the wider category of proximity attacks — the keyboard that is not a keyboard, the card copier, the tracker — start at cheap hacking gadgets explained. And because the captive-portal variant is really a credential attack, the account-side defences apply too: two-factor authentication, passkeys and a password manager so that a password typed into the wrong form is not also the password to everything else.