A rogue access point is one of the oldest tricks in wireless attacks, and it endures for one reason: it works on trust, not technology. The attacker does not break your encryption. They convince your device to connect to their network instead of the real one, and from that moment everything you do passes through their hands.
The good news is that spotting one rarely takes more than a minute. You do not need specialist gear or a security background. You need to know what to look for, and a free app on the phone already in your pocket. Here is the fast version.
First, Two Things That Both Get Called “Rogue”
The term covers two related threats, and it helps to know which one you are hunting.
| Type | What it is | Where you meet it |
|---|---|---|
| Rogue AP | An unauthorised access point plugged into a network it should not be on | Offices, larger home networks |
| Evil twin | A fake network copying the name of one you trust | Cafes, airports, hotels |
For most people, the evil twin is the one to worry about, because it targets you directly in public. The 60-second check below catches both.
The 60-Second Check
1. Look for the duplicate (10 seconds)
Open your Wi-Fi list. Two networks with the identical name is the classic evil twin signature. One is real, one is bait. If you see “CoffeeShop_WiFi” listed twice, treat both as suspect until you confirm which is genuine, usually by asking a member of staff.
2. Check the security type (10 seconds)
Attackers often run their fake network open, with no password, because it is easier to capture traffic that way. If the real cafe network uses a password and an identical-looking one nearby does not, that mismatch is a loud warning. A network that suddenly dropped its password since your last visit deserves the same suspicion.
3. Open a Wi-Fi analyzer (30 seconds)
This is the step that turns a guess into a verdict. A free Wi-Fi analyzer app lists the BSSID, the hardware address of each access point, alongside its signal strength. Two networks sharing a name but showing different BSSIDs confirms there are two separate boxes broadcasting it. A legitimate router from a known brand and a generic or oddly named hardware address sitting next to it is a strong tell.
Signal strength is the other giveaway. An evil twin run from a device in someone’s bag often shows an unusually strong signal because it is physically close to you, sometimes stronger than the real access point mounted on the ceiling.
For this step you need an app. On Android, WiFi Analyzer by farproc is free, reliable, and shows BSSIDs clearly without any setup. On iPhone, Network Analyzer by Techet does the same job, though Apple’s restrictions mean it requires one extra tap to surface the hardware address details. Both are free and available in their respective app stores.
4. Watch for the surprise login (10 seconds)
If a network you have used before suddenly throws up a login page asking for an email, a password, or worse, payment details, stop. Captive portals that harvest credentials are a favourite payload. A network you connected to last week without a sign-in screen should not demand one today.
For Your Own Network at Home
The home version of this check is even quicker. Log into your router and look at the list of connected devices. Anything you cannot account for is worth investigating. On a larger setup with several access points, note the BSSID of each of your own units once, and any new one that appears later stands out immediately. Turning off WPS and changing the default admin password closes the most common ways an attacker plants a rogue device in the first place.
Two settings are worth changing if you have not already. WPS, or Wi-Fi Protected Setup, is a convenience feature that lets devices join your network with a button press or PIN rather than a password. It sounds harmless but it has well-documented vulnerabilities that make it a common entry point for planting a rogue device. Turn it off in your router settings and you close one of the most frequently exploited doors. While you are in there, change the default admin password if you have not already. Router manufacturers ship every unit of a given model with the same credentials, and those defaults are publicly listed. Changing it takes thirty seconds and means an attacker who reaches your admin panel cannot simply walk in.
If You Find One…
Do not connect, and if you already have, disconnect immediately. Avoid logging into anything sensitive until you are on a network you trust. If it is impersonating a venue’s network, tell the staff, because they will want to know someone is operating a fake AP on their premises. And as a permanent safety net, run a VPN on public Wi-Fi, which encrypts your traffic even if you do connect to the wrong network by mistake.
The whole routine becomes second nature after a few tries. Glance at the list, check the lock, open the analyzer, watch for an unexpected login. A minute of caution is a small price for keeping a stranger out of the middle of your connection.
