Evil-twin Wi-Fi travel traps: fake hotspots, captive portals and one Australian conviction
Every airport, hotel and aircraft cabin now has its own familiar free network, and most travellers join it without a second thought. An evil-twin access point exploits that habit: it is a rogue hotspot borrowing the name of a legitimate one. Devices that joined the real network before may reconnect to the fake one automatically, and new arrivals cannot tell the difference, because Wi-Fi names carry no proof of identity.
From charge sheet to conviction
The clearest recent illustration comes from Australia. In April 2024 an airline reported a suspicious network mimicking its legitimate Wi-Fi during a domestic flight, and the Australian Federal Police began investigating. On 19 April 2024 officers searched a passenger's hand luggage at Perth Airport and seized a portable wireless access device, a laptop and a mobile phone. On 28 June 2024 the AFP charged the 42-year-old West Australian man with nine offences, alleging that fake networks at Perth, Melbourne and Adelaide airports, on domestic flights and at other locations served a page asking travellers to sign in with an email or social media account, with the entered credentials saved to his devices (AFP)."To connect to a free WiFi network, you shouldn't have to enter any personal details - such as logging in through an email or social media account," the AFP's Detective Inspector Andrea Coleman said when the charges were announced.The case did not end at the charge sheet. In November 2025 the AFP reported that the man, by then 44, pleaded guilty in Perth District Court to 15 charges and was sentenced to seven years and four months in prison, with parole eligibility after five years. Forensic analysis of his devices found other people's login credentials alongside thousands of intimate images and videos taken from women's online accounts. According to the AFP, the hardware was a portable penetration-testing tool marketed as a "Wi-Fi Pineapple", which listens for devices searching for networks they trust and clones one automatically - and the fake login pages never actually provided internet access. Their only function was harvesting (AFP).
Why the trick works
The mechanics are simple. A rogue hotspot broadcasting at higher power than the genuine network can push the real one off the list a phone displays; Kaspersky's analysis of the in-flight case notes that victims saw only the fake network because its signal was stronger (kaspersky.com). Captive portals do the rest: the page a traveller expects to see, asking for a room number, an email address or a social login, is precisely the page an attacker can counterfeit. Some settings concentrate the risk. Airlines increasingly stream entertainment to passengers' own devices over Wi-Fi, so joining a plane's network feels routine, and at altitude there is no cellular alternative. Kaspersky's author described the odds of such a scheme as "sky-high": hand over the credentials, or sit through the flight without entertainment.What HTTPS changes, and what it does not
The picture is less bleak than it was a decade ago. As the US Federal Trade Commission notes, most websites now use encryption, which is a large part of why it considers public Wi-Fi networks generally safer than they once were (consumer.ftc.gov). Transport encryption does the heavy lifting: an evil twin can relay your traffic, but a properly encrypted connection to the genuine site stays unreadable to whoever is relaying it. The caveats matter as much as the rule. Encryption protects the connection, not the decision made before it: a password typed into a fake portal is surrendered voluntarily, before any handshake with the real service. The FTC also cautions that the padlock symbol says nothing about who operates a site, since scammers obtain certificates for fake pages too. And even with everything encrypted, the rogue access point still sees metadata: which domains you resolve and which servers you contact. Notably, neither the Australian investigation nor the published analyses of such campaigns involve breaking encryption. They do not need to.A practical posture
None of this requires paranoia, only a short checklist applied consistently:- Treat any portal that asks for an email, social media or payment login as hostile; genuine free Wi-Fi does not need one, as the AFP advice after the case stressed.
- Verify the exact network name with staff on the ground, and with the in-seat instructions in the air, rather than trusting the strongest signal.
- Prefer your phone's tethering to shared hotspots where the plan allows it.
- Disable automatic joining, set devices to forget networks after use, and switch Wi-Fi off when it is not needed.
- Bring your own encryption: enable a VPN as soon as the connection is up and keep your usual Tor posture for anything sensitive; if the VPN will not connect, do not log into email or banking on that network.
- Never install apps, plug-ins or certificates a portal offers, and disconnect if one is requested.