What is happening here
A WiFi evil twin is a fake wireless network that copies the name of a real one. A QR code that joins you to WiFi can connect you to the fake network without you ever typing the network name, which makes the deception easy to miss.
Evil twins appear near cafes, hotels, airports, and conference venues, where people expect open or shared WiFi. The QR code may sit on a table card, a reception sign, or a flyer.
Red flags to check before you scan
- The network name is almost identical to the real one, with a small spelling change or an extra word.
- There are two networks with nearly the same name, and staff cannot confirm which one is theirs.
- The QR code is a sticker added to a sign rather than printed as part of it.
- The network asks for a sign-in, personal details, or payment before giving access, when the venue offers free WiFi.
- The connection drops, behaves oddly, or shows security warnings after you join.
Verify before you trust it
1. Ask staff for the exact network name and confirm the spelling before you connect.
2. Compare the network name shown by your phone with the name on official venue materials.
3. Avoid entering passwords, bank details, or sensitive accounts on a public network you have not verified.
4. Use mobile data for sensitive tasks when the WiFi cannot be confirmed.
Putting this into practice
Build a habit you can use in seconds. Pause before every unexpected scan, read the destination preview, and check the domain against what you already know. If the code is printed in public, look for sticker edges and compare it with nearby signs. If the code arrived in a message, verify it through a separate channel you trust. The pause costs almost nothing, and it is the step that catches most of these scams.
Common mistakes to avoid
The most common mistake is scanning to find out whether a code is safe. A scan that opens a page can already expose you to a fake login or a payment trap. Another mistake is trusting a familiar logo, since logos are easy to copy. A third is acting under urgency, which is exactly what the message is designed to create. Slow down, verify through a channel you control, and treat any request for credentials or payment as a reason to stop.
Quick checklist
- Pause before you scan any unexpected code.
- Read the full destination preview, not just the first hop.
- Compare the domain with the official one you already know.
- Check printed codes for sticker edges and mismatched print.
- Never enter passwords, codes, or card details from a surprise scan.
- Verify through a separate, trusted channel before you act.
Related tools and guides
- Run the destination through the [QR consent note builder](/qr-consent-note-builder) before you trust a code you did not expect.
- Inspect the code with the [QR phishing pattern trainer](/qr-phishing-pattern-trainer) before you trust a code you did not expect.
- Check the address with the [QR checksum generator](/qr-checksum-generator) before you trust a code you did not expect.
- Practise spotting patterns with the [bulk generator](/bulk-generator) before you trust a code you did not expect.
- Review the chain with the [QR placement guide](/qr-placement-guide) before you trust a code you did not expect.
- Keep a record with the [QR safety checker](/qr-safety-checker) before you trust a code you did not expect.
- Plan protection with the [QR size calculator](/qr-size-calculator) before you trust a code you did not expect.
