The Wi-Fi you joined at the airport is lying to you

October 4, 2026 · Seraf Inc. · 7 min read

You land, you open your laptop, and there's a network called Airport_Free_WiFi. You connect, you check your email, maybe you log into your bank. Nothing bad happens. You fly home.

What you probably didn't notice: that network might not have been the airport's at all.

This is the evil twin attack, and it's been around for two decades because it still works. An attacker sets up a wireless access point with the same name (SSID) as a legitimate one — or a plausible-sounding name in a place where people expect to find Wi-Fi. Devices connect, sometimes automatically. From that moment on, everything you send and receive flows through hardware the attacker controls.

Why your phone can't tell the difference

Wi-Fi networks identify themselves by two things: a name (the SSID) and a hardware address (the BSSID, roughly the access point's MAC address). Your device remembers networks by SSID. If you've connected to Hotel_Guest before, your phone will happily reconnect to any access point broadcasting that name — including one an attacker set up in the parking lot with a stronger signal.

Encryption helps less than people assume. An open network has no password to check, so any AP with the right name wins. A password-protected network is safer in theory, but if the attacker knows the password (and hotel and café passwords are rarely secret) they can run the same trick on a "secured" network.

What the attacker can see once you're connected

It depends on how careful you are, but the menu is long:

• Every unencrypted request. Plain HTTP sites, some older email protocols, some apps that don't pin certificates. Increasingly rare, but not gone.
• DNS queries. Even if your traffic is encrypted, the attacker sees which domains you're visiting — which is often enough to be interesting.
• Phishing pages. The classic move: intercept your request for your bank, serve a lookalike login page, harvest the credentials. Done well, it's nearly undetectable without checking the URL carefully.
• Downgrade attacks. Some attackers try to strip HTTPS or force older, weaker encryption. Modern browsers resist this, but not all apps are modern browsers.
• A man-in-the-middle position for anything else. Once they're routing your traffic, they can attempt more sophisticated attacks at leisure.

The common thread: none of this requires you to do anything stupid. You just connected to a network with a familiar name.

The warning signs you can actually check

You don't need to be paranoid, but a few seconds of attention before connecting saves a lot of trouble:

• Ask what the network is called. Airports, hotels and cafés almost always post the exact SSID somewhere. If the sign says HotelName_Guest and you see both HotelName_Guest and HotelName_Guest_Free, connect to the one on the sign.
• Be suspicious of duplicates. Two networks with the same name in the same place isn't normal. Neither is an open network with the same name as a password-protected one you've used before.
• Check the security type. If the real network was WPA2 and the one you're about to join is Open, that's a red flag. Your device usually shows this in the Wi-Fi list.
• Watch for unexpected captive portals. If a network you use all the time suddenly asks you to "log in" through a web page you've never seen, that's worth a second look.
• Trust certificate warnings. If your browser says a site's certificate is invalid on a network you don't fully trust, don't click through. That's often the only visible sign of an active interception attempt.

What Skopia shows you

When you join a network, Skopia's Nearby tab shows the basics you just connected to: the SSID, the BSSID, the security type, the gateway, and the other devices already on the network. If you've connected to the same name before from a different place and the BSSID has changed, that's visible. If the network you expect to be encrypted is open, that's visible too.

It won't stop you from connecting to a malicious AP — no app can, the decision is always yours — but it puts the information in front of you in a way that takes a few seconds to check, instead of digging through system menus.

Habits that actually protect you

• Use a VPN on untrusted networks. This is the single most effective defense. Even if the AP is malicious, an attacker who can only see encrypted tunnels has much less to work with.
• Disable auto-join for public networks. Both Android and iOS let you forget networks or disable automatic reconnection. It costs you a tap each time and prevents your phone from connecting to an evil twin while it's still in your pocket.
• Prefer cellular for anything sensitive. Banking, email login, work credentials — if you're not sure about the Wi-Fi, your phone's data connection is a safer path.
• Keep HTTPS-only mode on. Both Chrome and Firefox offer this. It makes downgrade attacks much harder.
• Turn off Wi-Fi when you're not using it. Simple, and shrinks the window in which your phone is announcing itself and looking for networks.

The bigger picture

Most public Wi-Fi is fine. The café down the street is not a honeypot. But the attack is cheap to run, hard to notice, and aimed precisely at the moment you're least likely to be paying attention — tired, in transit, in a hurry.

A few seconds of checking, a VPN you actually turn on, and a habit of cellular-for-banking cover most of it. The goal isn't to never use public Wi-Fi. It's to use it with your eyes open.