Fake Wi-Fi Hotspots on iPhone: How to Spot One Before You Connect

Answer First

Definition: A fake Wi-Fi hotspot — commonly called an “evil twin” — is a wireless network broadcast by an attacker who names it after a network you expect: a coffee shop’s guest Wi-Fi, a hotel’s lobby network, or an airport lounge SSID. CISA describes the technique plainly: an adversary gathers information about a public access point, then sets up their own system to impersonate it. To your iPhone, the fake and the real network are indistinguishable by name alone.

Why: A Wi-Fi network name (the SSID) is just a label anyone can copy. On typical open and shared-password networks, nothing verifies that the person behind the access point is the venue. Attackers can also broadcast a stronger signal than the legitimate access point, which pushes devices to prefer the impostor. The dangerous moments are the routine ones: joining the network, and typing something into the “please sign in” page that pops up next.

Example: You’re in an airport lounge. The Wi-Fi list shows “Sky Club” and “Sky Club 5G,” both strong. One is broadcast by a traveler with a portable hotspot, named to match the lounge’s network. Your iPhone joins the stronger one — the fake — and a login page asks for your email and password “to continue.” A VPN is running, and that’s the problem: it encrypts your traffic on whatever network you joined, but it won’t tell you this is the wrong network or stop you from typing credentials into the attacker’s page.

Key Facts

A network name is not an identity. Anyone can broadcast a hotspot named “Starbucks WiFi” or “Airport Free Wi-Fi.” CISA’s advice: confirm a public hotspot’s name and password before use, because the attacker’s system impersonates the real one.
Your iPhone has no way to verify the name. On open and shared-password networks, no authentication step ties an SSID to a business; the Wi-Fi list shows names and security badges, not ownership.
Attackers compete on signal strength. The evil twin often broadcasts a stronger signal so devices prefer it.
HTTPS protects page content, not page identity. Most sites encrypt traffic today, which is why the FTC calls ordinary public Wi-Fi use usually safe. But scammers create fake websites and even encrypt them, so a padlock means “encrypted in transit,” not “this page belongs to the airline.”
A VPN encrypts the link, not your choices. Apple’s documentation describes VPNs as tunneling your device’s IP traffic through an encrypted connection to a VPN server. That’s useful, but it does not select your network, authenticate the login page, or stop phishing.
iOS privacy features are not verification features. Private Wi-Fi Addresses and “Ask to Join Networks” reduce tracking and surprise joins; neither certifies a hotspot.

Expert Explanation

How an evil twin works

A hotspot broadcasts beacon frames announcing its SSID. Your iPhone collects those announcements into a simple list; you (or Auto-Join) pick one, and on an open network that’s it — no password, no certificate, no proof of who is behind the name. The attacker just needs to be in range, name the network like the venue, and optionally boost the signal.

The damage happens after connection. On a captive-portal network, iOS pops up a login page. The real portal asks you to accept terms or enter a code; the attacker’s can ask for anything: an email and password, a frequent-flyer number, even a payment card “to unlock premium speed.” The fake network controls the connection, so it can serve its own pages before you reach the real internet, watch which domains you visit, and steer you to lookalike sites via DNS tricks.

What a VPN does — and doesn’t — change in that moment

This is the part most public-Wi-Fi explainers skip. A VPN like SovaTun creates an encrypted tunnel between your iPhone and a VPN server, so the hotspot you’re on cannot read your traffic. On a fake hotspot, that genuinely helps: the attacker can’t read your page contents, form submissions to real sites, or DNS queries.

But the VPN starts after you choose a network. It cannot help you pick the right one, and it cannot verify the login page the network serves you.

Moment	What a VPN does	What a VPN does NOT do
Choosing which SSID to join	Nothing — you still see the same list	Tell you which network is the real venue
Traffic between iPhone and the internet	Encrypts it in a tunnel to the VPN server	Stop the hotspot from serving its own pages
The captive-portal login page	Nothing — the page renders as sent	Verify the page is the venue’s, or block credential entry
Phishing, malware, account compromise	Nothing directly	Prevent any of these; they happen above and below the tunnel

A VPN has limits beyond the table: it doesn’t prevent phishing, malware, account compromise, or all tracking, and it doesn’t change what happens between your iPhone and other devices on the same local network — see VPN Local Network Access iPhone: What Users Should Know.

Because the VPN server sees your traffic, choosing a VPN matters as much as choosing a network. When a VPN app turns out to be a data collector, as in the Facebook Onavo case, users learn that “encrypted” and “private” are not the same thing, and Apple’s App Store enforcement against such apps shows how to evaluate what you trust. Both stories are on our blog: When a VPN App Is a Data Collector and When Apple Pushes a VPN Off the App Store.

The practical limits of the VPN layer

On a fake hotspot, the two highest-value attacks — harvesting credentials from a fake login page and redirecting you to lookalike sites — happen at the application layer, where a VPN has no say. A VPN complements HTTPS and good judgment; it doesn’t replace either. If the wrong network is the front door to a phishing page, a VPN is a better lock, not a better door.

Decision Framework

Use this checklist before joining any public network. If you can’t tick most boxes, use cellular data instead.

Spot-the-fake checklist

Ask staff or read official signage for the exact network name — don’t assume the first match in the list is right.
If the venue’s real network requires a password, get it from staff; be extra wary of an “open” network wearing the same name.
Check the list for duplicates: two identical or near-identical names is a classic evil twin signature.
Question unexpected signal strength or a familiar name in an odd place.
Before typing into a captive portal, confirm with staff that the page is the venue’s, especially if it asks for credentials, payment, or personal data.
Never reuse a real password on a login page you can’t verify; a throwaway email is fine for terms-and-conditions portals.
Turn the VPN on before you connect, and disable “Auto-Join” so your iPhone doesn’t silently attach to a look-alike network.
For anything sensitive, use cellular data or your own iPhone Personal Hotspot.
After you leave, “Forget This Network” and change any password you typed while connected.

Rule of thumb: when in doubt, cellular.

Key Takeaways

A fake Wi-Fi hotspot is just a broadcast SSID that copies a name you trust; your iPhone can’t tell the real network from the impostor by name alone.
The attack completes at the login page, not the connection; that’s where credentials get harvested.
A VPN encrypts your traffic on whatever network you join; it does not choose the network, validate the login page, or stop phishing.
HTTPS protects content in transit, but a fake site with a padlock is still a fake site — the FTC is explicit.
Confirm names with staff, distrust duplicates and surprise-strong signals, and fall back to cellular for anything sensitive.
Pick a VPN you can trust with your traffic, since the VPN server sees everything you send; the Onavo and App Store enforcement stories show why.

FAQ

Q: Can my iPhone tell a fake Wi-Fi hotspot from the real network?

A: No. On the open and shared-password networks most venues run, the SSID is just a label your iPhone displays; no verification step ties a name to a business. Private Wi-Fi Addresses and similar iOS features reduce tracking but don’t certify a hotspot. Your best detector is offline: confirm the name and password with staff, and watch for duplicates or surprise-strong signals.

Q: If I’m using a VPN, am I safe from fake hotspots?

A: Safer on the connection, not on the network choice. A VPN like SovaTun encrypts your traffic in a tunnel, so the hotspot can’t read it. But it doesn’t stop you from joining the wrong network, and it doesn’t verify the captive-portal login page — typing credentials into a fake page is still dangerous with a VPN running.

Q: I think I typed a password into a fake login page. What should I do?

A: Disconnect immediately and “Forget This Network.” Change the password you entered — and anything else that uses the same password — from a trusted connection, turn on two-factor authentication for important accounts, and monitor them for unusual activity. Consider telling the venue’s staff so they can warn other customers.

Q: If most websites use HTTPS now, why bother with a VPN on public Wi-Fi?

A: HTTPS already protects the content of your browsing, which is why the FTC considers ordinary public Wi-Fi use “usually safe.” What it doesn’t do is hide your destinations from the network, protect you from fake login pages, or cover apps that send unencrypted traffic. A VPN adds a privacy layer on top, with the same limits described above: it can’t prevent phishing, malware, or account compromise.

Sources

FTC — Are Public Wi-Fi Networks Safe? What You Need to Know (https://consumer.ftc.gov/articles/are-public-wi-fi-networks-safe-what-you-need-know): encryption and HTTPS on public Wi-Fi; scammers encrypting fake websites.
CISA — Securing Wireless Networks (https://www.cisa.gov/news-events/news/securing-wireless-networks): evil twin attacks, stronger-signal impersonation, and confirming a hotspot’s name and password.
Apple Platform Security — Virtual private network (VPN) security (https://support.apple.com/guide/security/vpn-security-sec802e8ab55/web): how VPNs work on iPhone, including tunneling traffic through an encrypted connection.