Fake Wi-Fi and sign-in pages
At a hotel, café or airport, the Wi-Fi often shows you a sign-in page before it lets you online. You expect that page to appear, so you rarely question it, and that makes it a perfect place for a trick. In this lesson you’ll learn what a real sign-in page asks for and what it never does, and tidy up the networks your devices join without asking.
In this lesson
- Understand how Wi-Fi sign-in pages work, and how they’re abused
- Learn the three things a sign-in page should never ask for
- See and tidy the networks your phone and laptop join on their own
You’ll need: your phone, and your laptop if you have one.
How a sign-in page works
The page that asks for your room number, surname or a click on “Accept” is called a captive portal. Until you get past it, the network holds back your internet connection and sends every web request to that page instead. Your device notices and opens it for you automatically.
That moment has three weaknesses. You’re expecting a page, so a surprise one doesn’t feel odd. Whoever controls the network decides what that page is. And protections like a VPN can’t start until you’re through it.
What happened in 2026
On 31 July 2026, Microsoft described a campaign it calls CaptiveCrunch, run by a group linked to Russia’s foreign intelligence service. On hotel and conference Wi-Fi, guests expecting the usual sign-in page were shown something else: a fake “update your browser” or “repair your network” prompt that installed spyware, or instructions to type a code into a real Microsoft page, which quietly handed over the guest’s work account. Microsoft saw the group resume on 29 September. Our article Is Hotel Wi-Fi Safe? tells the full story.
Three things a sign-in page should never ask
- To install or update anything. No real Wi-Fi sign-in needs a browser update, a “network repair” tool, a certificate or an app. If a sign-in page offers you a download, close it.
- To type a code somewhere else. Some real sign-ins show you a short code to type on another device, but only when you started that sign-in yourself, such as setting up a smart TV. A Wi-Fi page that tells you to go to another site and enter a code is handing your account to someone else.
- For a password you use anywhere else. A room number, surname, a code from reception or an email address for the hotel’s records is normal. Your email password, work password or bank details never are.
Try it yourself · part 1
See which networks your devices join by themselves
Your phone remembers every network it has joined, and rejoins any network with the same name automatically. Anyone can name a network “Airport Free WiFi” or “Hotel_Guest”, so old entries like that are worth removing. Open the list on your device:
📱 iPhone
- Go to Settings, Wi-Fi, and tap Edit in the top corner to see your known networks.
- Tap the ⓘ next to any you don’t use any more and choose Forget This Network.
- For public networks you do use, tap ⓘ and turn off Auto-Join, so your phone only joins when you choose to.
🤖 Android
- Open Settings and search for Saved networks (on many phones it’s under Network and internet, Internet; on Samsung, Connections, Wi-Fi, then the menu and Manage networks).
- Tap any network you don’t use and choose Forget.
- For public ones you keep, open the network’s details and turn off automatic connection.
🪟 Windows
- Go to Settings, Network and internet, Wi-Fi, Manage known networks.
- Choose a network and click Forget.
- For public ones you keep, open them and untick Connect automatically when in range.
🍎 Mac
- Open System Settings, Wi-Fi, and scroll to Known Networks.
- Click the … button next to a network and choose Forget This Network, or turn off Auto-Join.
How many did you find? Most people have a dozen or more, from places they visited once.
Try it yourself · part 2
Your checklist for the next public network
- Check the exact network name with staff or on a sign at reception. If there are two that look similar, ask which is theirs.
- When the sign-in page appears, read its address as you learned in Lesson 2. It often belongs to the Wi-Fi company rather than the hotel, which is normal; a page that asks you to sign in to Microsoft, Google or your bank is not.
- Run through the three nevers: nothing to install, no code to type elsewhere, no password you use anywhere else.
- Once you’re through, switch on your VPN if you use one. For banking or work, your phone’s own hotspot is safer than any shared network.
- When you leave, forget the network, so your devices don’t rejoin a network with the same name somewhere else.
Key takeaways
- Wi-Fi sign-in pages appear before your protections start, which is why they’re abused.
- A sign-in page never needs you to install anything, type a code elsewhere, or enter a password you use for anything else.
- Your devices rejoin known network names automatically: forget the ones you don’t use.
- For anything important on the move, your phone’s hotspot beats shared Wi-Fi.
Check yourself
Three questions. Pick one answer each and you’ll see why.
1. The hotel Wi-Fi sign-in page says your browser is out of date and offers an update. What should you do?
2. A sign-in page asks you to go to a Microsoft page and type in a short code. What’s happening?
3. Why remove old public networks from your phone’s saved list?
Read the whole story of the 2026 attacks, and what a VPN does and doesn’t do on hotel Wi-Fi, in Is Hotel Wi-Fi Safe?
This lesson is part of the free course Scams and Staying Safe, licensed under CC BY-NC-SA 4.0: you may share and adapt it for non-commercial use, with credit to ExamineIP and a link to the original.