Airport Wi-Fi and hotel Wi-Fi are convenient when you travel this summer. They are also networks you do not control. Most of the time that is ordinary shared internet. Sometimes a lookalike name is sitting next to the real one.

That lookalike is an evil twin attack: a fake Wi-Fi hotspot that copies a legitimate network name so a phone or laptop joins the wrong one. This is a how-to, not a scare story. Confirm the real name. Turn off auto-join. Use HTTPS. Keep banking and ID on mobile data when you can. A VPN encrypts the path on untrusted Wi-Fi. It does not make you anonymous, and it does not stop malware or phishing.

The short version

  • An evil twin attack stands up a hotspot with the same name as a real airport or hotel network.
  • Phones that auto-join a remembered name can connect without you choosing.
  • Confirm the name with staff or on a sign. Prefer a password-protected network.
  • Look for https. A page that asks for email or social login to get “free Wi-Fi” is a reason to stop.
  • For sensitive tasks, use mobile data or your own hotspot.
  • A reputable VPN encrypts traffic on untrusted Wi-Fi. Arresti is Australian-owned and veteran-owned. No-logs. From AUD $3.99 a month or $43 a year, up to 5 devices, 30-day money-back.

What an evil twin attack is

Wi-Fi names are not unique. Anyone can broadcast a name that looks like the airport lounge or the hotel on your booking. Your device only sees the label. If that label matches one it already trusts, it may join automatically. That is the whole trick.

The Australian Cyber Security Centre’s public Wi-Fi guidance says the same thing in quieter language. Anyone can create a free hotspot. Names can be reused. Check the name on signage, or with staff. Disable auto-join. Prefer a password-protected network. Forget the network when you are done. If you are not sure, use mobile data. Look for https and the lock, and leave if the browser warns you. Turn off file sharing, and mark the network as public. Think twice before banking or sending ID. If you use public hotspots often, install a reputable VPN, and read the provider’s privacy policy.

How fake Wi-Fi works at an airport

In a typical evil twin attack the operator broadcasts the copied name, waits for a device to join, then presents a login page. The page can ask for an email or a social account. That is not how most genuine airport or hotel portals work. A real captive portal usually asks you to accept terms or enter a room number — not your inbox password.

Once you are on the wrong network, the operator can see hostnames you visit and anything that is not encrypted. HTTPS still protects the contents of most sites. Airport Wi-Fi safety is mostly about joining the real network, then adding a second layer if you stay on it. A VPN encrypts the path from your device to a server you choose, so the local network is no longer reading a site-by-site diary.

A real Australian example

This is not only an overseas story. On 28 November 2025 the Australian Federal Police reported that a West Australian man was sentenced in Perth District Court to seven years and four months’ imprisonment for creating ‘evil twin’ Wi-Fi networks to capture personal data.

The AFP says he used a portable wireless access device that listened for phones looking for known networks, then created a matching name so devices connected automatically. People were taken to a webpage and prompted to log on with an email or social media account. Those credentials were saved on his device. The page did not actually provide free Wi-Fi.

Investigators identified data relating to those fraudulent pages at airports in Perth, Melbourne and Adelaide, and on domestic flights.

In the same release, AFP Commander Renee Colley asked people to be vigilant on free Wi-Fi, especially at airports. Avoid a network that asks for an email or social account. If you do use public Wi-Fi, she said, use a reputable VPN, disable file sharing, skip online banking on that network, forget it when you disconnect, and switch Wi-Fi off in public if you want to prevent automatic joining.

That is the official advice. It is also enough.

Airport Wi-Fi safety: how to spot a lookalike

  • The name is close, but it is not on the sign or the boarding-gate screen.
  • A second network with almost the same name sits next to the real one.
  • The portal asks for an email, a social login, or a password you would not give a hotel desk.
  • Your phone joined something before you tapped it.
  • The browser warns you. Stop. Forget that network.

Safe habits at airports and hotels

  1. Confirm the network name with staff, on the hotel card, or on official signage.
  2. Turn off auto-join and auto-connect for public hotspots.
  3. Finish the real captive portal first — terms or room number — then connect a VPN.
  4. Use HTTPS. Leave if the browser warns you.
  5. Turn off file sharing. When asked, mark the network as public.
  6. For banking, ID scans, or anything you would not do on a stranger’s laptop, use mobile data or your own hotspot.
  7. Forget the network when you leave the lounge or check out.

For the October café and calendar note, see Public Wi-Fi on the last weekend of the QLD school holidays. For the tap-by-tap setup, see How to Set Up a VPN on Travel Wi-Fi.

A public Wi-Fi VPN in Australia: what it does

A VPN encrypts the path from your device to a VPN server. On airport or hotel Wi-Fi, that means the local network is not reading your traffic hop by hop. That is the job.

It does not make you anonymous. Logged-in sites still know you. It is not antivirus. It does not stop phishing. It will not undo a password you typed into a fake portal. Those limits make the purchase honest. You are buying encryption on networks you do not run.

If you want a public Wi-Fi VPN in Australia from a company that is here, Arresti is Australian-owned and veteran-owned. No-logs: we do not store browsing history. We do collect what we need to run your account — email, country, and payment through Stripe on the web.

From AUD $3.99 a month or $43 a year. One plan. Up to five devices. 30-day money-back. Apps for iOS, Android and macOS. Windows from the download page. Plans and the money-back terms are on pricing.

We wrote down what “no-logs” actually means. If that sentence matters, read it, and the Privacy Policy.

Install before you travel if you can. Confirm the real network. Connect the VPN. Use summer airport and hotel Wi-Fi as a shared network — with one extra, quiet hop on the path.

Sign Up Now