Evil twin access points: how they work and how to prevent them

An evil twin is a rogue access point that broadcasts the same network name as a real one so nearby devices join it. Prevent it by authenticating the network side, not just the user: use certificate validation with 802.1X, require protected management frames, and use encrypted application traffic regardless of the network.

How the trick works

Devices remember network names. If your phone has joined "OfficeWiFi" before, it will join anything advertising that name with a strong enough signal, provided the security settings look compatible.

An attacker sets up a device with the same name, sometimes with a stronger signal, and can also send forged disconnect messages to push people off the real network. The victim reconnects to the copy. From there the attacker can capture traffic, serve fake login pages, or collect credentials.

Why open and shared password networks are exposed

On an open network there is nothing to prove who runs it. On a shared passphrase network, the attacker may not even know the passphrase and still capture some information, or may simply learn it from a staff member who shared it at a coffee shop.

On a network using username and password through 802.1X, the risk depends on whether clients check the server certificate. If they do not, the twin can collect login attempts.

Controls that actually help

1. Validate the server. For 802.1X, configure clients to trust only your certificate authority and the exact server name. Push this by device management so users never see a prompt.
2. Protect management frames. The Wi-Fi Alliance states that protected management frames are required on WPA3 networks. They protect unicast management frames against forging and eavesdropping, which makes forced disconnects harder.
3. Use certificates on devices. A device certificate means credentials are not typed into anything an attacker can imitate.
4. Keep application traffic encrypted. TLS and a tunnel to your gateway mean a hostile network sees much less.
5. Scan for rogue access points. Enterprise access points can report unknown devices advertising your names. Review those alerts.

Habits for people on the road

• Turn off auto join for open networks.
• Forget networks you will not use again.
• Prefer a phone hotspot to unknown public Wi-Fi when handling sensitive work.
• Treat certificate warnings as stop signs.

What to do if you suspect one

Note the location and time, capture the network details such as the hardware address, and report it to whoever runs wireless. Change any credentials typed on that network. If staff were prompted for passwords on an unfamiliar page, treat those accounts as exposed and reset them.

For the broader question of public networks, see is public Wi-Fi safe.

Quick check

Sources

• Wi-Fi Alliance security overview

Last reviewed: 19 October 2026.