Free Public Wi-Fi Is Not Free: How Fake Hotspots Steal Your Data (and How to Stay Safe)
Airports, hotels, cafés and bus stations offer free Wi-Fi. Some of it is poorly secured. Some of it is a trap with a name that looks like the real thing. Sir Brown AD explains how it works and the simple habits that keep you safe.
You land at the airport, your data is low, and a network appears on your phone: Airport_Free_WiFi. One tap and you are online. It feels harmless. For most people it is. But for the few times it is not, the cost can be a hijacked email account, a stolen password, or an emptied bank account.
Public Wi-Fi in airports, hotels, cafés, malls, event halls and transport stations is often poorly secured. Sometimes it is worse than poorly secured. Sometimes the network is not run by the venue at all.
Free Wi-Fi is not a gift. Either the venue is paying for it, or someone else is getting something from you. Know which one you are connecting to.
The Trap: The Fake Hotspot With a Familiar Name
Anyone with a laptop or a small portable device can create a Wi-Fi network and call it whatever they like. Nothing stops them from naming it after the venue: Hotel_Guest, Cafe_Free_WiFi, Station_Public. This is often called an evil twin network.
The attacker then waits. Phones are built to be helpful, and many are set to join networks automatically, so a device may connect with no tap at all. Once you are on their network, all your traffic passes through their equipment before it reaches the internet. They are sitting in the middle, and you cannot see them.
What a Bad Hotspot Can Do
Show you a fake login or sign-in page that asks for your email, phone number or social media password
Watch which websites and apps you use, and when
Try to capture details you type into websites that are not properly encrypted
Redirect you to a fake version of a site, such as a lookalike bank or email page
Push fake update pop-ups designed to install harmful software
The common thread is the one you will recognise from other articles on this platform: they do not need to break anything. They need you to trust the wrong thing.
Even Real Networks Can Be Weak
New Updates
Not every risk comes from a criminal. A genuine hotel or airport network may have no password at all, or a password shared with hundreds of guests. On an open or widely shared network, other users on the same Wi-Fi can sometimes probe your device, and the network itself may be badly maintained. Free does not mean checked, and it does not mean private.
The Rule: Keep the Important Things Off Public Wi-Fi
CISA, the United States cybersecurity agency, advises people to avoid entering passwords or personal information on public networks when possible. That is the heart of it. The simplest protection is not a tool. It is a decision.
Do not do these on public Wi-Fi unless you have no choice:
Online banking and fintech apps
Moving money, paying bills or buying things with your card
Logging into work systems, company email or admin dashboards
Entering passwords on sites you do not normally use
Checking account recovery or password reset emails
If it can cost you money or access, it can wait until you are on a safer connection.
If You Must Use It, Use These Layers
Use HTTPS websites only. Look for the padlock and https at the start of the address. This encrypts the content between you and the site. It does not prove the site is genuine, so check the address carefully, as covered in our fake bank website guide.
Switch on multi-factor authentication for email, banking and social accounts, and prefer an authenticator app over SMS. If a password is stolen, a second step can still stop the attacker.
Use a trusted VPN where appropriate. A VPN encrypts your traffic between your device and the VPN provider, which makes snooping on the Wi-Fi far less useful. Choose a reputable paid provider. A random free VPN can be worse than no VPN, because it may log or sell what you do.
Ask staff for the exact network name and password. Do not guess from the list, and be suspicious if two networks look almost identical.
Never accept pop-ups asking you to install an app, certificate or update just to get online.
Log out of accounts when you finish and forget the network afterwards.
The Better Option: Your Own Data
Your phone's mobile data, or a hotspot from your own phone, is almost always safer than a public network, because you control who connects to it. For banking, payments and anything sensitive, use your mobile data. A few hundred naira of data is cheaper than a stolen account.
Settings to Change Today
Turn off automatic Wi-Fi joining for open networks
Tap Forget on old networks you no longer use, especially airport, hotel and café ones
Turn off file sharing, AirDrop or Nearby Share to Everyone while in public
Keep your phone and apps updated, because updates fix the weaknesses attackers rely on
Switch Wi-Fi off when you are not using it
Warning Signs You May Be on a Fake Network
A network with no password that has a very similar name to the real one
A sign-in page that asks for more than a name or room number, such as your email password or card details
Browser warnings about an unsafe or invalid certificate. Do not click through them
Sudden requests to log in again to services you were already logged into
Pages that look slightly wrong, load oddly or redirect unexpectedly
If you notice any of these, disconnect immediately and switch to mobile data.
What to Do If You Think You Were Caught
Disconnect and forget the network. Change the passwords of any accounts you used, starting with your email, from a trusted connection. Turn on multi-factor authentication if it was off. Check your bank and fintech apps for transactions you did not make, and contact your bank using the number on your card if anything looks wrong. If you installed something during the session, run a security scan and consider a reset after backing up your files.
THE SAFEST PUBLIC WI-FI HABIT IS SIMPLE: IF IT INVOLVES YOUR MONEY OR YOUR PASSWORDS, USE YOUR OWN DATA.
Conclusion
Public Wi-Fi is useful for reading the news, watching a video or sending a casual message. It is a poor place for the things that matter most. Fake hotspots succeed because they look helpful and cost nothing, and that is exactly why they work. Keep sensitive activity on your own connection, protect your accounts with multi-factor authentication, use HTTPS and a trusted VPN when you have to, and treat free Wi-Fi the way you would treat a stranger offering you a free phone charger: it might be fine, but you do not hand over everything you own to find out.
Platforms like browncode.name.ng will keep publishing practical security guides, because the best protection is learned before an attack, not after.
Get new Security & Fraud alerts
One email when a new security & fraud article like this one goes live. No spam, unsubscribe anytime.
Join my WhatsApp channel
Get new articles, fraud alerts and web security tips straight to your phone.
Found this useful? Share it.
Someone you know may be about to fall for a scam or make a costly mistake. Send them this.
This article was originally written and published by Sir Brown AD.
Advertise with us
Sir Brown AD
Keep reading, or tell me about what you're building.
Discussion