The fake free WiFi honeypot
A fake WiFi access point with a familiar name harvests passwords and payment details. Most-documented in Indonesia, Thailand, Turkey, Mexico. Field guide: how the scam works, how to spot it in five seconds, and what to do if you fall for it.
Also called: Evil twin WiFi, WiFi pineapple, Fake hotspot.
How the scam works
A laptop or phone in a café or airport broadcasts a free WiFi network with a name similar to the legitimate one ("Starbucks_Free," "Airport_Free_WiFi"). When you connect, the operator can intercept all unencrypted traffic, redirect you to fake login pages for your bank or email, or push malware to your device. Increasingly common in Bali, Bangkok airports, Istanbul, and Mexico City coffee shops.
How to spot it in 5 seconds
- Two similar-named WiFi networks appear in your list — one is fake
- A captive portal redirects you to a login page that does not match the venue's logo
- You are asked to enter email/password to "verify" — legitimate captive portals usually don't require credentials
- Pages load slowly or have weird SSL certificate warnings
- No legitimate WiFi password posted at the venue (ask staff)
What to do if you fall for it
- Use a VPN on all public WiFi (NordVPN, ProtonVPN, Mullvad all work fine in most countries)
- Disable auto-connect to open WiFi on your device — it makes honeypots easy
- Never log into banking apps on unfamiliar WiFi without a VPN
- If you suspect you logged in to a fake page, change the password on the real site immediately
Frequently asked questions
Where is the The fake free WiFi honeypot most common?
The The fake free WiFi honeypot is most-documented in Indonesia, Thailand, Turkey, Mexico, India. Reports come from FCDO and US State Department advisories, embassy briefings, and Warnely's editorial team. The scam can happen anywhere these patterns repeat — watch for the warning signs above regardless of country.
Is this scam dangerous or just annoying?
This scam is high-risk: it can involve significant financial loss, drugged drinks, or physical intimidation. Take the recovery steps above seriously and report to local police and your embassy.
What should I do if I am being scammed right now?
Step away from the situation if safe. Walk to a busier, public, well-lit area. If you have been robbed: block bank cards via your banking app within minutes. If you have been physically threatened: call the local emergency number (varies by country — see the country guide) and your embassy. Most embassies operate 24/7 emergency lines.
Will my travel insurance cover this?
Most travel insurance policies cover theft and fraud if you file a police report within 24 hours and provide the report number when claiming. Card fraud is usually reversed by your bank if reported promptly. Spiked-drink medical costs are typically covered as medical emergencies. Always check your specific policy before travel.