An evil twin is a rogue Wi-Fi access point that copies the name of a legitimate network so devices connect to it by mistake. You spot one by checking the network name with staff, watching for certificate warnings and odd login pages, and not letting devices auto join open networks.
Definition
Wi-Fi networks announce themselves with a name, the SSID. Nothing in a basic open network proves that the name belongs to the venue. Anyone can run an access point with the same name. Phones and laptops that have joined a network before may reconnect on their own when they see that name again.
That is the entire trick. The attacker does not need to break encryption. They need you to choose the wrong network, then sit in the middle of your traffic or show you a fake sign in page.
Why open networks are the easy target
The Wi-Fi Alliance describes traditional open networks as having no protections at all, and it offers Wi-Fi Enhanced Open as a way to add unauthenticated encryption. Encryption without authentication helps against passive listening. It does not prove which network you joined. See What is WPA3 and Enhanced Open for the difference.
Signs you may be on a fake network
- Two networks with nearly identical names, such as one with an extra word or a different capital letter.
- A sign in page that asks for more than a room number or a code, for example a corporate password or a card number.
- A browser certificate warning on sites that normally load cleanly.
- A sudden disconnect followed by a request to reconnect or sign in again.
- A network you never saw before, yet your phone joined it without asking.
None of these proves an attack, but each is a reason to stop and check.
What limits the damage
HTTPS is the main defence. A browser connects to a site over TLS, and a fake access point cannot present a valid certificate for the real site. MDN explains that HSTS tells browsers to only use HTTPS for a host and not to let users bypass secure connection errors on later visits. That is why a certificate warning is meaningful and why you should not click through one. The details are in Does HTTPS protect you on public Wi-Fi? HSTS explained.
Other habits help:
- Turn off auto join for open networks and delete old hotel and conference networks after the trip.
- Ask staff for the exact network name and read it from their sign, not from the list.
- Use a phone hotspot for sensitive work, as covered in Phone hotspot or hotel Wi-Fi for work.
- Use MFA that resists phishing, since a fake login page cannot easily replay a hardware key.
For team leads
Add two lines to your travel guidance: do not enter work passwords on a Wi-Fi sign in page, and report any network that asks for them. Managed devices can also be set to forget open networks; check what your device management tool offers.
Safeguard does not defend your Wi-Fi. It covers the software supply chain, with dependency scanning, SBOMs and policy gates, so you can catch risky changes whichever network they were pushed from. A free scan takes a few minutes.
Quick check
Can an evil twin read my HTTPS traffic?
Not the content, if the connection is valid HTTPS. It can see which hosts you contact and can attempt to trick you with fake pages or warnings you click through.
Does a password on the Wi-Fi network prevent evil twins?
A strong, unique key helps, since an attacker without it cannot complete the connection. A password printed on a wall for all guests is much weaker.
Sources
Last reviewed: 19 October 2026.
