Public Wi-Fi 'evil twin'
Fake Wi-Fi hotspots at airports and cafés that capture your logins.
How it works
A scammer sets up a hotspot with a name like 'Airport_Free_WiFi'. When you connect, a captive portal asks you to sign in with Google / Apple — handing over your credentials and access to every linked service.
Common scenarios to watch for
This scam shows up in several different shapes. Recognise the pattern, not just one message.
Airport free Wi-Fi clone
A hotspot named like the airport's official network shows a captive portal asking for Google login.
"Welcome to Sydney_Airport_Free — sign in with Google to continue."
Red flags to spot
- Does the Wi-Fi name look official but have slight variations?
- Is the captive portal asking for a Google or social media login?
- Does the page look different from the airport's usual branding?
- Are you being asked for more than just terms acceptance?
Café 'sign-in to keep using'
After 10 minutes of free Wi-Fi, a captive page says you must 'verify' with Facebook to continue.
"Your free trial has ended — log in with Facebook for another 60 minutes."
Red flags to spot
- Is the Wi-Fi asking for social media login after a short free period?
- Does the captive portal look unprofessional or different from the café's branding?
- Are you being asked for permissions beyond normal Wi-Fi access?
- Can you ask staff to confirm the official network name?
Hotel-room 'premium internet'
Captive portal asks for full credit card to 'upgrade' your room's internet speed. Card details go straight to the scammer.
"Hotel WiFi (Premium) — $9.95/night for HD streaming, enter card to upgrade."
Red flags to spot
- Is the hotel Wi-Fi asking for credit card details for 'premium' access?
- Does the captive portal not match the hotel's usual check-in process?
- Are you being charged for something that should be included or free?
- Can you verify with reception which Wi-Fi network is official?
Red flags
- 🚩Two similar Wi-Fi names in the same place
- 🚩Portal asks for full Google / Apple / Facebook login
- 🚩No HTTPS padlock on the captive portal page
- 🚩Speed test redirects through a strange domain
What to do
- 1Use your phone hotspot or a trusted VPN in public.
- 2Never sign into accounts through a Wi-Fi captive portal.
- 3Turn off 'auto-join' for open networks on your device.
Who's targeted
- Travellers at airports, hotels and cafés.
- Students working from public libraries.
Why it works
- People expect free public Wi-Fi and choose the strongest signal.
- Captive portals 'feel' official, so login forms aren't questioned.
Common variations
Different shapes of the same scam — recognise the pattern.
- 1'Airport_Free_WiFi' rogue hotspot.
- 2Fake hotel network with a captive portal asking for room number + card.
- 3Conference Wi-Fi clone that injects malicious downloads.
If you've already been scammed
- 1Change passwords for any account signed into on that network.
- 2Run a malware scan on the device.
- 3Turn on 2FA for important accounts.
Frequently asked
Is a VPN enough?▾
It blocks snooping, but won't stop you typing your password into a fake page.
Is my phone's hotspot safer?▾
Yes — your data isn't on a shared network you don't control.
What about HTTPS?▾
Helps, but doesn't stop phishing if you log into a lookalike URL.
Questions people ask about this scam
- How does the public wi-fi 'evil twin' work?
- A scammer sets up a hotspot with a name like 'Airport_Free_WiFi'. When you connect, a captive portal asks you to sign in with Google / Apple — handing over your credentials and access to every linked service.
- What are the warning signs of a public wi-fi 'evil twin'?
- Watch for: Two similar Wi-Fi names in the same place; Portal asks for full Google / Apple / Facebook login; No HTTPS padlock on the captive portal page; Speed test redirects through a strange domain.
- How can I tell if this is a scam?
- Stop and verify independently. Contact the organisation using details you look up yourself, never the ones in the message, and don't act on urgency. You can also paste the message into the ScamShield AI scam checker for a risk assessment — it gives guidance, not a guarantee.
- What should I do if I clicked the link or replied?
- Stop all contact, change the password on any account you logged into and turn on two-factor authentication, and watch your accounts for changes you didn't make. Use your phone hotspot or a trusted VPN in public. Never sign into accounts through a Wi-Fi captive portal. Turn off 'auto-join' for open networks on your device.
- What should I do if I already sent money?
- Contact your bank immediately and ask about stopping or recalling the payment, keep all evidence, then report the scam. Be wary of anyone who later offers to recover your money for a fee.
- Where should Australians report this scam?
- Report scams to Scamwatch (National Anti-Scam Centre), report cybercrime to ReportCyber, forward scam texts to 7726, and contact IDCARE if identity details were exposed. Contact your bank first if money is involved.
General scam awareness information. ScamShield AI cannot guarantee that every scam will be detected or that a message is legitimate.
Related scams
Connected patterns you should also learn — ranked by how much they overlap with this one.
Fake job offer
'Easy money' jobs that ask for an upfront fee or your bank details.
Read guideRental bond scam
Fake landlords asking for a bond before you inspect.
Read guideEducation fee scam
Fake 'agents' offering tuition discounts via wallet transfer.
Read guideSubscription trap
'Free trial' offers that quietly bill your card every month.
Read guideHacked social media account
A friend's hacked account messaging you to 'vote' or claim a prize.
Read guideFake event ticket scam
Sold-out concert and sports tickets that don't exist.
Read guide