Travel and connectivity

The Hotel Wi-Fi Captive Portal Scam, October 2026

Updated 23 October 2026

You assume the splash screen asking for your room number and last name is the hotel. It is not, and the page you are about to fill in was put there by someone parked two floors up with a pineapple. The cost of that assumption starts at a cloned loyalty account and ends at an empty current account.

What the captive portal scam actually is

A captive portal is the small web page that pops up the first time you join a public Wi-Fi network. It is the screen that makes you agree to terms, type a room number, enter a loyalty code, or hand over an email before the internet opens up. In a real hotel, that screen is hosted by the venue's own networking gear. In the scam version floating around this October, the screen is hosted by an attacker who is sitting in the lobby, on a balcony, or in the car park with a portable hotspot and a piece of hardware called a Wi-Fi pineapple, which is a small box that pretends to be a familiar network name.

The technique is not new, but the wrapper is. Threat researchers at CrowdStrike and reporting from BleepingComputer through 2025 and 2026 describe a steady move away from crude hotspots and towards "evil twin" access points that broadcast the same SSID as the hotel next door, the airport lounge, or the conference centre. Your phone sees two networks with the same name. It usually picks the one with the stronger signal, which happens to be the attacker's box in the next-door unit.

Once you connect, the rogue portal asks for the same things a real one would: room number, last name to validate the stay, loyalty programme number, sometimes a card on file for incidentals. The information goes straight into a spreadsheet on the attacker's laptop. In several October 2026 incidents observed at UK chain hotels and US airport hotels, the cloned page also asked the user to sign in with a Google or Microsoft account, which gives the attacker a session cookie they can replay from their own browser, no password required.

The trick works because the design is convincing. The attacker is not building a website from scratch. They are using a free captive portal template, swapping in the right brand colours, the right logo, and a passcode field that reads as if it has always been there. You walk in, you join the network, the page appears, and the cognitive load of a tired traveller takes over.

The tell, the law, and who is on the hook

Real captive portals are usually served over HTTPS with a certificate that matches the venue, and they are pushed to your device by the network itself, not by a website you typed in. If you open your browser manually and visit a normal site first, and the page comes up automatically, that is a captive portal working as designed. If you have to click a link in a "connect to Wi-Fi" poster, a QR code taped to the desk, or a text from the front desk, treat it as hostile by default.

The most reliable tell in October 2026 is the URL bar. Real hotel portals run on the hotel's own domain, a subdomain of the chain, or a well-known Wi-Fi vendor like Cisco, Aruba, or Cloud4Wi. A rogue portal will be on a freshly registered domain, often a string of letters and numbers, or a page hosted on a free file sharing service. Look for HTTPS, then look at the actual domain, not the padlock. The padlock only means the connection to the attacker is encrypted. It does not mean the attacker is trustworthy.

Other tells: the page asks for your card CVV to "verify Wi-Fi access" (a real portal never does), the page asks you to install a profile or a certificate on your phone to "improve your connection" (this gives the attacker the ability to inspect your other traffic), or the page demands your date of birth and full address to "register your device". The legal basis for processing that data does not exist under UK GDPR or under most US state privacy laws, so no reputable brand would ask for it.

On the law, the UK has had wiretap-adjacent offences on the books for years. Interception of communications without consent is an offence under the Regulation of Investigatory Powers Act 2000, section 1, and the malicious creation or use of a computer program to gain unauthorised access to data is covered by the Computer Misuse Act 1990, section 3. In the US, the FBI's Internet Crime Complaint Center groups captive portal cloning under "spoofing and phishing", and federal prosecutors have used the Computer Fraud and Abuse Act, 18 U.S.C. § 1030 for the same conduct. The venue itself is not the criminal, but it can be civilly liable for failing to secure the network, especially in jurisdictions that have codified a duty of care.

Who is on the hook for the money depends on how the card data was taken. If you typed a card into a cloned portal and used it within 60 days, the Consumer Credit Act 1974, section 75, makes the card issuer jointly liable with the merchant for misrepresentation or breach of contract in the UK. If the data was skimmed but the card was used later as a stolen instrument, the issuer is on the hook under PCI-DSS rules and most card scheme chargeback policies. In practice, you dispute the transaction, the issuer refunds, and the scheme goes after the merchant of record. The loyalty account is harder. Most chain programmes treat the account holder as responsible for activity under their credentials, so the chain is under no obligation to reinstate stolen points.

What to do in the first hour after you realise

Step one is to disconnect from the network and turn Wi-Fi off. Airplane mode, then back on with Wi-Fi still off. If you have a laptop open, close it, then disable the Wi-Fi adapter in the system settings. The goal is to break the attacker's session before they pull any more data.

Step two is to switch to your phone's mobile data and, from there, change the password on any account you typed in: email, loyalty programme, cloud storage, anything that signed in through the portal. If you signed in with Google, go to myaccount.google.com/security, find "Your devices", and revoke the session from the hotel's network. The same path exists for Microsoft at account.microsoft.com/security. If the page asked you to install a profile on an iPhone, go to Settings, General, VPN and Device Management, and delete the profile, then forget the network.

Step three is to call the bank that issued the card you typed in, even if you only typed the last four digits. Tell the fraud team the merchant descriptor and the time, and ask for a watch flag on the card. Most UK and US issuers will replace the card as a precaution, which is annoying on a trip but cheaper than a drained account. File the dispute in writing inside 30 days, in line with the Consumer Credit Act 1974 in the UK and Regulation E in the US.

Step four is to report the portal. Tell the hotel front desk, in person, and ask to see the duty manager. A reputable property will check the network, isolate the rogue access point, and preserve logs. Ask for the incident reference in writing. Then report the incident to Action Fraud in the UK or the FBI's IC3 in the US. If the attack happened at work or on a work-issued device, tell your IT team the same hour. They will want to rotate credentials and check for lateral movement, especially if the rogue portal injected a JavaScript payload that pulled session cookies for internal tools.

Step five is to keep an eye on the loyalty account for the next 90 days. Watch for new redemptions, address changes, and emails about password resets you did not request. If points vanish, the chain's fraud team can usually trace the redemption to a specific reservation, but the burden of proof is on you to show the account was compromised via a portal you did not control. Screenshot everything now, while the evidence is fresh.

How to keep yourself off the hook next time

The single most useful habit is to treat every public Wi-Fi network as hostile until proven otherwise. That sounds paranoid. It is also the only setting that matches the threat model in October 2026. A VPN on your phone, with the kill switch on, will not stop you typing your card into a cloned portal, but it will stop the attacker reading the rest of your traffic if they somehow get past the captive page. The two settings to check on any VPN client are the kill switch and DNS leak protection. Both default to off on most consumer apps.

The second habit is to confirm the network name at the front desk before you join. A real chain will print the SSID on the key card wallet, the in-room TV, or the lobby stand. If the network you can see is not on that list, do not join it. If the list names two networks, a main and a "premium" tier, ask which one is the property's and which is a third-party operator. Conference centres and airport lounses often resell bandwidth through a partner brand, and the partner brand is a popular impersonation target.

The third habit is to use your phone's mobile data for anything sensitive. Mobile data is encrypted on the radio link, authenticated by your SIM, and routed through your carrier. A rogue hotspot can read the payload, but it cannot easily insert itself in the middle. If you have a UK Three, EE, O2, or Vodafone plan, your inclusive roaming in the EU covers most trips. If you do not, a 30-day eSIM from a reputable provider is cheaper than one card replacement.

The fourth habit is to set up a password manager with a unique password for every loyalty account. A password manager will refuse to autofill on a domain it has not seen before, which is a free early warning. If the manager refuses to fill your real password on what looks like a hotel portal, that is the captive portal scam in the act. Stop, switch off Wi-Fi, and use mobile data.

The fifth habit is to leave a review. Other guests at the same hotel need to know the portal is being cloned, and the chain needs the operational pressure to fix it. A short, factual review that names the date, the network name, and the symptoms is more useful than a generic complaint. The chains with the best captive portal hygiene in late 2026, based on incident reports, are those that run their own controller on a ".hotel" domain, serve a branded certificate, and rotate the portal page every 24 hours. If your chain does not do that, the next guest is the next victim.

What the venue itself should be doing

Hotel groups, airport lounges, and conference centres are not powerless. The cost of a real captive portal solution has fallen sharply since 2023, and the gap between a secure deployment and a vulnerable one is mostly a matter of policy. The minimum a venue should be doing in October 2026 is to run 802.1X authentication, which lets the network check the device and the user before granting access, instead of a free-for-all with a splash page. The next step up is a managed service like Cisco Spaces, Aruba ClearPass, or a Cloud4Wi deployment, which gives the venue a dashboard of every device on the network, the ability to push a branded certificate, and the ability to isolate rogue access points within minutes.

Smaller venues that cannot afford managed gear can still harden the basics: disable WPS, turn off legacy authentication, name the SSID something distinctive, and put the captive portal on a subdomain of the venue's own domain. The portal should never ask for a card CVV, a date of birth, or a national ID number. It should accept a room number, a last name, or a booking reference, and it should hash and discard that data within 24 hours.

If you are reading this as an IT or operations lead at a hospitality brand, the question to ask the team this week is: how quickly can we detect a rogue access point broadcasting our SSID? If the answer is longer than ten minutes, the next incident is a matter of when, not if. The cost of a detection system, in the low thousands of pounds, is a fraction of one chargeback cycle from a victim who sues the venue for contributory negligence. The legal duty is tightening in both the UK and the US, and the case law from 2024 and 2025 has not been kind to venues that shrugged.

This is general safety information, not legal advice. Scams change. If you need an official desk: FTC ReportFraud or IC3.