wifi

How to Tell if a Wi-Fi Network Is Fake, and Why the Padlock Will Not Tell You

secure-os· Updated September 5, 2026· 5 min read #wifi#privacy#network#threat-model

A white flat wireless router standing on a pale surface with its four antennas raised, each lit from behind so they glow bright pink against a green and cream gradient wall

The uncomfortable answer first: from the client side, you often cannot tell. A network name is just a string that any device can broadcast. Nothing in the Wi-Fi standard stops a laptop in a backpack from announcing Airport_Free_WiFi next to the real one, and nothing tells your phone which of the two is legitimate.

That is not a flaw someone forgot to fix. Open Wi-Fi has no mechanism for a network to prove who it is. So the useful question is not how to detect a fake, it is how to make connecting to one harmless.

Still, some signals do mean something. Here they are, ordered by how much weight they deserve.

Signals that are worth something

Two networks with the same name, different security. If you see CafeName twice and one is open while the other asks for a password, that is the strongest single indicator available to a normal user. Duplicate names alone are common and innocent, because large venues run many access points on the same name. A mismatch in security type is not innocent.

A captive portal that asks for more than it should. Real venue portals ask you to accept terms, sometimes for an email address. A portal asking for a password to an existing account, a card number, or permission to install a certificate or profile is not a venue portal. Installing a certificate is the one that matters most: it is the step that lets the network read traffic that would otherwise be encrypted.

Signal strength that does not match the room. A network that is stronger than the venue’s own, from a direction where there is no equipment, is worth noticing. This one is soft, easily explained by a repeater, and should never be your only reason.

The name is subtly wrong. Starbucks_WiFi next to Starbuks WiFi, or a network named after a venue two doors down. Ask the staff which one is theirs. It sounds too simple to be a technique, and it is the most reliable check on this list.

Seen from the street through a large café window, a person with dark hair sits at a counter working on an open laptop, a phone charging beside it, while the glass reflects a man in a dark coat walking past on the pavement outside

Signals that mean nothing, and are quoted constantly

The padlock in your browser. HTTPS tells you the connection to that site is encrypted. It says nothing about who runs the network. A rogue access point can carry perfectly valid HTTPS traffic all day and still see every domain you visit, when you visited it, and how much data moved.

A password on the network. A shared password printed on a receipt is known to everyone in the room, including whoever set up the fake. WPA2 with a shared passphrase protects you from a passive listener who does not have it, and from nobody else.

The network being in your saved list. That is the trap rather than the reassurance. Devices reconnect automatically to remembered names, so a fake carrying a name your phone already trusts gets connected to without anyone deciding anything. Delete public networks from your saved list after you use them. On iOS this is Forget This Network, on Android it is under saved networks, on Windows it is Manage known networks.

What a fake hotspot can actually do

Being precise here matters, because both exaggeration and dismissal are common.

An attacker running the access point can see every domain you connect to, through DNS and TLS handshakes, along with timing and volume. That is a detailed picture of your session even when the contents stay encrypted.

They can redirect unencrypted requests, which mostly means the first request before a redirect to HTTPS, and any application that still talks in the clear.

They can present a captive portal that imitates a login page you expect to see. This is the part that works, because it exploits the one moment when you already expect an unusual page.

They cannot read a properly validated HTTPS session, which is why the certificate warning is the line that should never be clicked through. If your browser objects to a certificate on a public network, the answer is to stop, not to continue.

The habit that makes the question stop mattering

Stop trying to identify the network and change what the network can observe.

Use a VPN on public Wi-Fi, or your phone’s own connection through tethering. A tunnel moves the observation point from whoever runs the hotspot to whoever runs the tunnel, which is a choice you made rather than one made for you. What that does and does not hide is covered in does a VPN hide your browsing from your ISP, and the same limits apply here.

Turn off automatic connection to open networks and delete saved public networks. This removes the entire class of attacks that rely on a name your device already trusts.

Turn Wi-Fi off when you are not using it. A device with Wi-Fi enabled is announcing itself, and in some configurations the names it is looking for.

Encrypted DNS closes the most detailed part of what the network operator sees, and is worth setting up once: secure DNS. None of this identifies a fake hotspot. It makes connecting to one a much smaller event, which is the outcome you actually wanted.