Fake Hotspots and Look-Alike Network Names

What a look-alike network is

Every Wi-Fi network has a name, called an SSID, that anyone nearby can see. There is no central registry, so nothing stops two networks from having similar or even identical names. A person can set up a hotspot called “Cafe_Free_WiFi” next to a business whose real network is “Cafe Free WiFi,” and a phone has no easy way to know which is genuine.

This is the basic idea behind fake hotspots, sometimes called evil twin networks. The goal is usually to get you to connect, then show a login page asking for details, or to sit between you and the internet. It is a real technique, though most people who use public Wi-Fi never encounter a deliberate attack, and the more common problem is simply picking the wrong network by accident.

Why it works

A few ordinary habits make look-alike names effective.

• Names are unverified. Anyone can choose any name, including the name of a hotel, airport or store.
• Signal strength looks like trust. The strongest signal appears first in the list, which can make it feel like the right one.
• Phones reconnect automatically. If your device has joined a network called “Free WiFi” before, it may join another with the same name without asking.
• People are in a hurry. Hungry, tired or late travelers choose quickly.
• Open networks have no password, so nothing proves the network belongs to the venue. A network with a password the venue gives you is somewhat better, though not a guarantee.

Confirm the name with staff

The most dependable check is also the simplest: ask a person who works there.

1. Ask for the exact network name, spelled out, and the password if there is one.
2. Compare it letter by letter with what your phone shows. Watch for extra words such as “Guest,” “Free,” “Secure” or “Fast,” added punctuation, swapped letters, or capital I and lowercase l that look alike.
3. If a sign or receipt lists the network, check that it matches what staff told you. Printed information is a reasonable check, though a sign could be altered, so it is better when two sources agree.
4. If the venue says it does not offer Wi-Fi, do not join any network claiming to be theirs.

Hotels often hand out the network name and a room-specific code at check-in. Cafes may print them on receipts. These are both better than guessing from a list.

Signs that something is off

None of these proves a network is fake, but each is worth a pause.

• Two networks with nearly the same name, one of which staff do not recognize.
• A login page asking for more than the venue normally would, such as your email password, bank details or a card number “to verify your identity.” A genuine hotspot sign-in rarely needs that. Entering a name, room number or email is common; passwords for unrelated accounts are not.
• A page that looks unfinished, has spelling mistakes or opens a strange address.
• Browser warnings about certificates or an insecure connection. Do not click through them.
• A network that wants you to install a “certificate,” app or profile before you can connect. Decline.

Remember that the padlock in the address bar only shows that the connection to a site is encrypted. It does not prove the site is trustworthy,; its meaning is narrower than many people assume.

Reduce the chance of joining the wrong one

• Turn off automatic joining for public and open networks in your device’s Wi-Fi settings. Look for an option such as “auto-join” or “connect automatically.”
• Forget old networks you will not use again, so your phone does not reconnect without being asked.
• Switch Wi-Fi off when you are not using it, and use mobile data if you can. Sensitive tasks outside the home are better saved for later or done on mobile data.
• Keep your software current, since updates often improve how devices handle these situations.
• Use apps and sites that encrypt traffic. Most major services do. A VPN is sometimes suggested; it can add a layer of protection on a network you do not trust, but it is not a cure-all, and the value depends on a provider you trust. Home VPN use is a similar balanced question.

If you think you joined the wrong one

Stay calm and take these steps.

1. Disconnect and tell your device to forget the network.
2. Do not enter any passwords or personal details. If you already did, change the password for that account from a trusted connection, starting with email.
3. Review recent activity on accounts you used and look for account takeover signs.
4. Tell the venue’s staff, who may want to know that a look-alike network exists.
5. If you entered payment details, contact your bank using the number on your card.

Two-step sign-in turned on beforehand limits the harm from a stolen password, which is one of many reasons to set it up before you travel.

Keep it in proportion

Fake hotspots make good headlines, but ordinary mistakes, such as choosing the wrong network by accident or clicking a phishing link, are the more common trouble. A short question to a staff member, plus turning off auto-join, covers most of the risk without turning a coffee break into a security exercise.