How to spot a fake public Wi-Fi network

A fake hotspot can look as harmless as the café Wi-Fi used every morning in Melbourne or the free guest connection at Sydney Airport. Warning signs often involve a mismatch between the expected network, sign-in page and behaviour of the devices you open.

Knowing how to tell if public Wi-Fi is a honeypot means checking its identity and limiting exposure, rather than expecting a perfect diagnostic. An attacker can copy a familiar network name, while a genuine network may be open, slow or strangely configured.

Understand the honeypot risk

People often call a malicious public hotspot a honeypot. The usual attack is an evil-twin access point: a nearby device broadcasts a familiar service set identifier (SSID) and may run a fake portal, intercept traffic or collect credentials. WPA2 or WPA3 encryption reduces casual snooping, but it does not authenticate a hotspot when an attacker knows or copies the connection details.

More reassuring signal	Warning sign	Practical response
Staff confirm the exact network name and password	A nearby hotspot has the same or a similar name	Disconnect from the duplicate and ask which access point is legitimate
A site address and certificate match the website	The browser reports a certificate or hostname warning	Stop rather than bypassing the warning
The portal uses an official venue domain	A page requests an existing account password or device-profile installation	Close the page and verify the portal address
A VPN is active before browsing	The device silently switches to another network	Disconnect and check the connection details

No single sign settles the matter. A padlock protects an HTTPS connection from casual reading, but it cannot prove who operates the Wi-Fi. An open network with a simple venue login page can still be legitimate, especially at an airport or large shopping centre.

Check the network identity

On iPhone, open Settings > Wi-Fi and use the information button beside a connected network. On Android, open the Wi-Fi details for the current connection. Compare the SSID, security type, IP address and router or gateway address with what you expect. A public service may be labelled Open, WPA2 or WPA3 and may use a randomised MAC address. A duplicate name or an unexpected home network is a reason to stop, but it is not conclusive proof of malicious activity.

Ask venue staff for the exact SSID, including capitals and any date or location suffix, and whether a password is required. Many Australian cafés put a Wi-Fi code on a receipt, while Melbourne Airport and Sydney Airport provide official guest-network details. Do not trust an advertisement or search result that merely resembles the venue’s name. Turn off automatic joining for unknown networks and forget any connection you cannot verify.

Inspect the captive portal

A legitimate captive portal usually redirects a browser to a named login page, perhaps briefly through an HTTP address, and explains the terms or access code. Read the final web address and check that the venue’s domain is spelled correctly. A misspelled domain, certificate warning or redirect to an unrelated login service should end the session; never click through a browser warning simply to reach the internet.

An airport or café portal may request an email address or mobile number to deliver a code, so some personal details are not automatically fraudulent. It should not request an existing email, Google, Apple or banking password, nor ask you to install a configuration profile, grant device administrator access or enter card details for free Wi-Fi. If uncertain, ask staff for the portal address using a separate device or printed sign.

Test the connection cautiously

Start with the safest available connection. Use mobile data for anything sensitive, especially if the café network is open. If browsing is unavoidable, activate a trusted VPN before opening sites, then confirm the VPN indicator and the address of each website. A VPN encrypts traffic between the device and its server; it does not make an unknown hotspot trustworthy.

For a limited check, open a familiar HTTPS website without signing in and confirm that the displayed hostname and certificate belong to that site. A DNS leak test can show whether DNS requests are escaping a VPN, but it cannot identify the access-point owner and should not involve signing into an account. Avoid random network-scanner apps that request location access or encourage certificate installation.

Limit what the network can capture

On any unverified public connection, postpone banking, email, payroll, superannuation accounts, health portals, cryptocurrency exchanges and password resets. A fake portal can imitate a genuine bank page, and HTTPS alone does not prevent credential phishing. If the task cannot wait, switch to mobile data, tether from a known device or return to a trusted home connection.

Reduce the available information before connecting: install updates, enable screen lock and multifactor authentication, and use unique passwords or passkeys where supported. Avoid prompts to disable certificate checks, antivirus or a firewall. Download only from expected app stores, close sensitive tabs when finished and use the phone’s forget-network control after leaving.

Account for Australian conditions

Local habits make these checks important. Australians commonly connect while waiting for a train, shopping in a Sydney or Melbourne CBD, or working from a library and café. Melbourne Airport and Sydney Airport provide free guest Wi-Fi, but portal pages, network names and authentication steps can change. Official airport signage is more reliable than a saved network whose name matches an earlier visit.

Legal context provides another reason to read a portal carefully. Under the Privacy Act 1988 (Cth), covered organisations handling personal information must follow the Australian Privacy Principles, including explaining what they collect and how it is used. That transparency does not authenticate a network, so check the portal’s privacy notice and whether an email address is optional. ACSC guidance also favours trusted connections and avoiding sensitive transactions over untrusted Wi-Fi.

Respond and choose a safer connection

If something feels wrong, turn Wi-Fi off, forget the network and continue over mobile data. On a managed work device, contact the IT team rather than testing it further. If a password or payment details were entered, change the affected password from a trusted device, revoke active sessions, review multifactor authentication and notify the bank or provider immediately. Remove any configuration profile that was installed and check recent account activity.

Before the next connection, create one secure note containing the network name and any password confirmed by venue staff.