You can't fully verify a public network from your phone, but you can rule out the most common traps in about a minute. Run through these checks before you join.
- Confirm the exact network name with staff. The FCC suggests asking an employee for the hotspot's name. Evil twin attacks rely on a fake network with a familiar name, like the one Australian police say a man set up on domestic flights and at airports in Perth, Melbourne and Adelaide.
- Look for duplicates. Two networks called "Cafe_Guest" and "Cafe Guest Free" is a red flag. Pick the one staff named, or skip both.
- Read your phone's warnings. On an iPhone, tap the info icon next to the network. A privacy or security warning flags weak encryption (open, WEP or old WPA), blocked encrypted DNS, or a carrier hotspot that could be spoofed. Open networks with no password at all are the weakest option.
- Inspect the login page. A legitimate captive portal asks you to accept terms, maybe enter a room number or a loyalty email. It should never ask for your Google, Microsoft or bank password, a credit card for "free" Wi-Fi, or tell you to install an update or certificate.
- Check sites after you connect. Your bank and email should load over HTTPS without certificate warnings. If your browser complains about a certificate on a site that normally works, disconnect.
If anything fails these checks, use your phone's hotspot instead. Passing them doesn't make the network trustworthy, it only means nothing obvious is wrong.