Browse the site
Services
Who We Serve
Problems We Solve
Across India
Guides & Resources
Questions
Blog
Profiles
Company
Call Get a quote

What Is a Rogue Wi-Fi Hotspot?

A rogue Wi-Fi hotspot is an access point that broadcasts a familiar network name without the owner's permission, so your phone joins it instead of the real one. The attacker then reads or changes the unencrypted traffic that passes through it, which is how credentials and session tokens are stolen. Avoid it by verifying the network name and the physical access point before joining, disabling auto-connect on phones and laptops, using a VPN on untrusted networks, preferring a mobile hotspot over open wifi, and running a wireless scan in your own building to find unauthorised transmitters.

Key takeaways

  • A rogue hotspot is usually the evil twin type: it copies the SSID of a legitimate network, and the client cannot tell the difference because the name is all most users check.
  • The realistic impact is credential theft on unencrypted sites, session hijacking on sites you have already logged into, and DNS redirection, not a dramatic crash.
  • Automatic wifi connection is what makes evil twin attacks work silently, because a phone will rejoin a familiar name without asking you.
  • Indian CERT-In advisories have repeatedly warned staff about rogue wireless networks and fake captive portals used to harvest banking credentials.
  • A wireless intrusion system or a monthly manual scan of the visible SSIDs and BSSIDs is the only reliable way to find an unauthorised transmitter in your own building.

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

How does a rogue Wi-Fi hotspot actually work?

There are two common shapes. The first is the evil twin: the attacker stands up an access point with the same network name as a legitimate one, usually at stronger signal strength so phones pick it, and the client connects to it thinking it is home or work. The second is the stand-alone fake, such as a free hotspot named like an airport lounge, that simply invites you in. In both cases the access point is now the path for all your traffic. The trick is that the connection still shows the expected name and often a padlock, so nothing looks wrong. The interception itself is easy, because plenty of traffic is still sent without encryption at the transport layer.

How do I tell a real network from an impostor?

Four practical checks, none needing special tools. Compare the network name you are joining with the one printed on the wall or on the router, and check the signal: a rogue point beside you is often stronger than the real one down the corridor. Look at what the captive portal asks for. A legitimate guest portal asks only for a code, while credential-harvesting portals ask for a bank username, password or card number. Never type a password into a portal that appeared without you typing the address yourself. On a laptop, list the visible networks and check whether several share a name with different vendor addresses, which points to a twin.

How do I stop a rogue hotspot inside my own office?

You stop it by finding it and by making the legitimate network the obvious choice. Find it with a scheduled wireless scan listing SSIDs, BSSIDs and vendor fingerprints, then trace any unknown access point through the switch MAC tables back to a wall socket or a desk. Remove it, and if it was a personal hotspot, treat it as a policy issue too. To reduce the incentive, give guests a proper guest network that performs well, because people run their own hotspot wherever the legitimate wifi is slow. Log the wireless events centrally, so a new device appears as an event rather than a surprise.

How the common Wi-Fi attacks on staff differ, and the control that stops each one
AttackWhat the attacker doesControl that stops it
Evil twinBroadcasts a copy of your real SSID at a stronger signalDisable auto-connect, verify the network name, use a VPN
Fake captive portalImitates a hotel or airport login pageNever type bank credentials into a portal you did not open yourself
Deauthentication floodForces clients off the real network so they rejoin the fake one802.11w management frame protection, wireless intrusion detection
Standalone free hotspotInvites you onto a network you control entirelyPrefer mobile data, avoid unknown free SSIDs
DNS redirectionSends domain lookups to a hostile resolverDoH or DoT on the client, trusted resolvers on the router
Credential reuseUses credentials captured earlier elsewhereUnique passwords, password manager, multi-factor authentication

What are the frequently asked questions?

What is a rogue Wi-Fi hotspot and how do I avoid it?
A rogue Wi-Fi hotspot is an access point that broadcasts a familiar network name without the owner's permission, so your phone joins it instead of the real one. The attacker then reads or changes the unencrypted traffic that passes through it, which is how credentials and session tokens are stolen. Avoid it by verifying the network name and the physical access point before joining, disabling auto-connect on phones and laptops, using a VPN on untrusted networks, preferring a mobile hotspot over open wifi, and running a wireless scan in your own building to find unauthorised transmitters.
Is a Wi-Fi network with a padlock icon safe?
Not on its own. The padlock only means the traffic is encrypted between your device and that access point. On a rogue hotspot, the attacker holds the other end of that connection, so the padlock tells you nothing about who is running the network. It also says nothing about a legitimate network, where the operator may still log destinations.
Can a rogue hotspot be used to hack my phone directly?
Rarely directly, but it is effective at stealing what you send. The realistic outcomes are harvested banking credentials from a fake portal, hijacked sessions using a captured cookie, and malicious file downloads. Keeping the phone patched, refusing to install apps over a network you do not control, and using a VPN on untrusted wifi all reduce the impact.
How do I find out if my office has a rogue access point?
Run a wireless scan that lists every visible SSID and BSSID with vendor information, and compare that with the access points listed in your own controller. Anything extra is a candidate. A monthly scan plus a physical walk of each floor finds most of them, and a wireless intrusion system automates the check for larger sites.
Should I use a VPN on my office wifi?
On untrusted networks, yes. A VPN encrypts your traffic across the access point, which closes the interception route that a rogue hotspot relies on. On your own properly secured office network, it is still useful because it protects traffic that leaves the building over the internet, but it is not a substitute for a segmented, monitored network.

Get a straight answer on this

Tell us your office floor area and device count, and we will run a wireless survey that lists every access point transmitting inside your building.

Send us the details See pricing

Last reviewed: 24 October 2026. Information on this page is general guidance, not legal advice. Prices are indicative bands for a typical scope and are confirmed in a written quote before any work begins.