You land, you turn off airplane mode, and your phone reconnects to Airport_Free_WiFi without asking you. It has connected before, so it trusts the name.
Your phone has no way of knowing that the access point answering to that name today is a battery-powered device in someone's backpack two gates down.
This is the evil twin: a fake wireless access point broadcasting a network name that people and their devices already trust. It is the oldest trick in wireless security and it survives because of a design decision made decades ago — Wi-Fi networks are identified by a name, and on open networks nothing proves that the access point using a name is the same one that used it yesterday.
Why your device cooperates
Your phone and laptop keep a list of networks they have used and rejoin them automatically. For open networks, the only credential is the name. Broadcast Starbucks WiFi from a device with a strong antenna and every phone in range that has ever used a Starbucks will try to associate with it.
Attackers often improve their odds by knocking clients off the real network. Management frames in Wi-Fi — the messages that handle joining and leaving — were historically unauthenticated, so an attacker could forge a "disconnect" message from the legitimate access point. Devices drop, look for the strongest signal with a familiar name, and land on the twin. Newer standards protect these frames, but the protection is only in effect if both the network and the device support it, which on public open networks is rarely a safe assumption.
Once you associate, the attacker is your gateway. Every packet leaving your device passes through hardware they own.
What they can and cannot see
This is where most advice goes wrong in one of two directions — either "public Wi-Fi steals your bank details" (largely obsolete) or "HTTPS solves everything" (also wrong).
Here is the honest version.
Well protected. The contents of nearly everything. HTTPS is close to universal, browsers refuse plain HTTP by default, and modern sites use HSTS to instruct browsers never to downgrade. The classic attack of stripping encryption from a login page has been mostly engineered out. An attacker on the network cannot read your messages or your banking session.
Still visible. A great deal more than people expect:
- Every domain you visit. Unless you have specifically enabled encrypted DNS, your lookups are plaintext. The network operator watches a live list of every hostname your device requests.
- The destination of every connection, from the IP address and, on many connections, the server name sent during the TLS handshake.
- Timing, volume and patterns. Traffic shape identifies video streaming, calls, and often which app is running.
- Everything your device does unprompted. Apps updating, cloud sync, push connections, corporate VPN endpoints — a detailed inventory of your digital life, gathered passively before you have opened anything.
The remaining active risks. The attacker controls DNS, so they can send you to a lookalike server for domains you have not visited before. They control the captive portal — that "accept terms to connect" page — which is a plain browser window under their control, and a natural place to prompt for an email, a booking reference, or a fake login. They can also block services selectively, pushing you toward a weaker alternative.
So the modern threat is not usually theft of your password. It is comprehensive surveillance of your behaviour, plus a handful of practical hooks for a targeted attack.
What actually helps
Turn off automatic joining for open networks. On both iOS and Android you can tell the device to ask before joining. This alone removes the silent-reconnect problem that makes evil twins work.
Treat the captive portal as hostile. Accept the terms, close the page. Never enter an email address, room number, booking code or password into it.
Prefer your phone's hotspot. Cellular is not private from your carrier, but it is not shared with the person sitting behind you. When a mobile connection is available, it is the better default.
Encrypt DNS. Both major mobile platforms and every mainstream browser support DNS over HTTPS or TLS. It closes the single most revealing leak on a shared network.
Use a tunnel for everything else. This is the piece the other steps cannot cover. A VPN wraps all traffic — every app, every background process, DNS included — in one encrypted connection to a single endpoint. The evil twin operator is left with an opaque stream to one address. No hostname list, no per-app fingerprint, no ability to redirect you, and no useful captive-portal position, because your traffic is not interpretable to them.
That is the specific, bounded claim worth making: a VPN does not make you anonymous and it does not protect you from a phishing email or a malicious download. What it does is remove the local network from the list of parties who get to watch you — and on airport, hotel, conference and café Wi-Fi, the local network is run by someone you have no reason to trust and no way to identify.
Check which endpoint you are trusting. Because a VPN moves the observation point rather than deleting it, the operator's logging policy is the entire question. A provider running RAM-only infrastructure with no session logs has nothing to hand over; a free VPN monetising traffic data has simply sold your position at the coffee shop to a bidder you will never meet.
The evil twin is not sophisticated. It costs about forty dollars of hardware and relies on a device doing exactly what it was designed to do. Which is why the defence is not cleverness — it is refusing to let an untrusted network see anything worth having.