Does a VPN Protect You From an Evil Twin Wi-Fi Attack? What It Stops and What It Doesn't

Also on CyberFence: check your public IP and geolocation · compare CyberFence to other VPNs side-by-side .

Short answer: partly. A VPN protects what you do after you connect, because it encrypts your traffic so the owner of a fake hotspot cannot read it. It does not stop you from joining the fake network, and it does not make a fake login page safe. The second part is where people get caught, so this guide covers both.

What an Evil Twin Attack Is

An evil twin is a Wi-Fi network built to look like a real one. The MITRE ATT&CK framework describes it this way: attackers host seemingly genuine access points that copy the name of a legitimate network, and they may use a stronger signal or block the real access point to push devices onto the fake one. They can also listen for the networks your device has joined before and answer with the same name. Once you are on it, the attacker may monitor activity, manipulate data, or steal credentials, often by sending you to a fake login page. MITRE notes that airports, coffee shops, and libraries are common targets.

Your phone makes this easier than you would expect. Devices tend to rejoin networks they already know, so a familiar name can be enough.

A Real Case: Fake Airline Wi-Fi

This is not a lab-only trick. In April 2024, Qantas employees noticed a suspicious Wi-Fi network on a domestic flight that mimicked the airline's customer Wi-Fi portal, according to the ABC. The Australian Federal Police traced it to Michael Clapsis, who used a Wi-Fi Pineapple, a device built for network testing. SecurityWeek reports that the device answered requests from people looking for free Wi-Fi by creating a network with the targeted name, then showed a fake login page asking for email or social media credentials. It was used at airports in Perth, Melbourne and Adelaide as well as on flights.

The stolen logins were then used to get into private accounts. The ABC reports that he stole or copied more than 700 photos and videos belonging to 17 women and girls over more than six years. He was sentenced on November 28, 2025, to seven years and four months in prison. The lesson for everyday travelers is simple: the damage came from passwords typed into a page, not from anything that happened to the network traffic itself.

What a VPN Does in This Situation

Once your VPN is connected, your device sends traffic through an encrypted tunnel to the VPN server. The owner of the fake hotspot can see that you are connected to a VPN server and roughly how much data moves. They cannot read the pages you visit or the data you send inside the tunnel. That matters because an evil twin sits in the middle of everything you do.

A small university lab study backs this up. In a paper titled Evil Twin Attack Mitigation With Virtual Private Networks, students tested an evil twin built with a Wi-Fi Pineapple. Without a VPN, data was compromised even though the network used Wi-Fi encryption and a captive portal. With a full-tunnel VPN, the tests showed the initial credential-sniffing attack could be bypassed. This was a controlled lab setup, so treat it as supporting evidence, not proof that every real-world attack fails.

You might wonder whether HTTPS already covers this. It helps a great deal, and browsers warn you about bad certificates. But MITRE notes that attackers may use custom certificates in an attempt to intercept HTTPS traffic, which is why a certificate warning on a public network deserves a full stop, not a click-through. A VPN adds a second layer. Provided it also handles your DNS lookups, the pages you visit and the requests your apps make leave your device inside the tunnel, not out in the open on the hotspot.

What a VPN Cannot Do

• It does not stop the fake login page. The same study found that the captive portal still appeared on every tested Wi-Fi security type with the VPN in place, and concluded that VPNs "do not inherently prevent exposure to malicious portals." Anything you type into that page goes to whoever runs it. Our guide to protecting your identity on public Wi-Fi covers what to keep off those pages.
• It does not tell you the network is fake. A VPN cannot verify who runs a Wi-Fi network. It only protects traffic inside the tunnel.
• It does not fix a password you already gave away. If you entered your email password on a fake portal, the attacker has it. Change it right away. Reused passwords make this worse, as we explain in our credential stuffing guide.
• It does not stop you from installing something bad. If a portal asks you to download software "to connect," close it. A VPN will not decide that for you.

How to Spot an Evil Twin

• Two networks with the same or nearly the same name, or a network that is open when you expected a password.
• A login page that asks for your email or social media password. Real hotel and airport portals typically ask you to accept terms, or enter a room number or last name.
• A page that asks for payment details or asks you to install an app or certificate.
• Browser certificate warnings. MITRE advises training people to be suspicious of "Open" or "Unsecure" access points and certificate errors.
• Sudden disconnects from the real network, followed by a prompt to join another one.

A Safe-Use Routine

1. Confirm the network name with staff, and ask for it exactly as written.
2. Turn off auto-join for public networks, so your phone stops rejoining names it recognizes.
3. Connect your VPN as soon as you join, before you open email, banking, or work apps.
4. Never type an email or social media password into a Wi-Fi sign-in page.
5. Use your phone's hotspot for banking or sensitive work when you can.
6. Use unique passwords and two-step sign-in, so a single stolen password is not enough.

For more on specific places, see our guides to airport Wi-Fi risks and using hotel Wi-Fi for banking, and for the bigger picture, whether a VPN protects you on public Wi-Fi.

Where CyberFence Fits

• AES-256-GCM encryption protects traffic inside the tunnel on a network you do not control.
• A kill switch blocks traffic if the VPN drops, instead of falling back to an open connection. See our kill switch explainer.
• Web Shield DNS blocking can stop known phishing and malware domains, though it will not catch a fake portal hosted on the hotspot itself. More in how DNS filtering works.
• A US-operated company with a zero-logs policy.

CyberFence also offers Breach Monitor, a separate product that alerts you when your email address shows up in a new leak. It will not stop a fake portal, but it can tell you sooner if a password has been exposed. See what Breach Monitor is.

The Bottom Line

A VPN is a strong protection against what an evil twin can see once you are connected, and it is worth turning on before anything else on a public network. It is not a defense against the login page. The two habits that matter most are the ones no app can do for you: never give your email or social password to a Wi-Fi sign-in page, and treat any unexpected prompt to install something as a stop sign.

Want to go deeper? Read our free IP address checker , the CyberFence competitor comparison hub , or CyberFence plans and pricing .