Man-in-the-middle attacks: what they are and how to protect yourself

What a man-in-the-middle attack is

In a normal connection, your device talks directly to a website, with only the network in between. In a man-in-the-middle (MITM) attack, someone slips into that path. They can watch what passes through, steal what is useful, such as passwords or card numbers, and in some cases change messages on the way. Both ends think they are talking to each other, so nothing looks wrong.

A common picture is a fake bank chat. The victim thinks they are talking to the bank, and the bank thinks it is talking to the customer, while an attacker in between collects everything and makes use of it. The pattern appears wherever people trust a connection they cannot see.

This kind of attack used to be easy because most of the web was unencrypted. Today most sites use HTTPS, which scrambles the traffic between you and the site, so a MITM attacker usually has to trick you into something first: joining their network, accepting a bad certificate, or typing details into a lookalike page. That is why the habits at the end of this guide matter more than any special software.

The common ways it happens

• Evil twin Wi-Fi. An attacker sets up a wireless network with the same name as a real one, such as a cafe or hotel, often with a stronger signal. Devices set to auto-connect may join the fake network, and the attacker can then see or tamper with traffic that is not properly protected.
• Tampered DNS lookups. DNS is the “phone book” that turns a website name into an address. If an attacker corrupts it, a real name can lead to a fake copy of the site that looks identical and collects whatever you type.
• Local network tricks. On a shared network, an attacker can send forged messages so that traffic meant for the router passes through their device first. This is one reason shared and public networks are riskier than your own.
• SSL stripping. The attacker keeps your connection on plain, unencrypted HTTP instead of the secure HTTPS version. You may not notice, because the padlock is missing.
• Session hijacking. After you log in, a site gives your browser a small token to remember you. If an attacker steals it, they can act as you without knowing your password.
• Fake support chats and lookalike pages. A scammer who gets you to talk to them instead of your bank, or to log in on a copied page, is effectively sitting in the middle. This overlaps with phishing; our link safety checker helps with the lookalike part.

Warning signs

• Your browser shows a certificate warning or says a connection is not private, especially on a site that has always worked.
• A site that should be secure loads without the padlock, or the address starts with “http” instead of “https”.
• You are asked to log in again on a page that normally remembers you, or the page looks slightly different.
• A Wi-Fi network has a familiar name in an unfamiliar place, or asks for more details than usual to get online.
• Your connection is oddly slow or keeps dropping on a network that is usually fine.
• You get password reset or login alerts you did not request.

None of these proves an attack, but together they are a reason to stop, disconnect and use a different network.

How to protect yourself

1. Never click through certificate warnings on sites where you log in, pay or read email. The warning is the browser telling you the identity of the site cannot be trusted.
2. Look for HTTPS and the right address. Check the web address carefully. Our link safety checker flags lookalike names.
3. Be careful with public Wi-Fi. Check the exact network name with staff, and turn off “auto-connect” for public networks. For banking or anything sensitive, use your phone’s mobile data instead.
4. Use a VPN on untrusted networks if you want an extra layer. A reputable VPN encrypts traffic between your device and the VPN company, which helps on shared Wi-Fi. It is not a cure-all, and you are trusting the VPN company instead, so choose carefully.
5. Turn on two-factor authentication. Even if a password is captured, the attacker still needs the second step. Passkeys and security keys are the strongest, because they are tied to the real site and cannot be handed over to a fake one. See our two-factor walkthrough.
6. Log out of sensitive accounts when you finish, especially on a shared computer.
7. Keep devices updated and free of malware, since malware can steal session data directly. See our malware guide.
8. Secure your own network. A weak home router is an easy place to tamper with lookups. Follow our router security checklist.
9. Do not log in through links in messages. Type the address yourself or use your saved bookmark or app.

How defenders look for it (in plain terms)

People who run networks use more technical checks, but the ideas are worth knowing because they show what an attack leaves behind:

• Watching for unexpected changes in network settings, such as a different DNS server.
• Checking certificates for errors or unexpected issuers.
• Looking for unusual traffic paths or patterns.
• Reading logs for unusual sign-ins or odd locations.
• Using certificate-based sign-in for Wi-Fi and VPN, so that passwords are not sent over the air at all.

If you manage a small business network, ask your IT provider whether they do these checks, and whether staff laptops are set up to warn about unsafe networks.

An illustrative example

This is a made-up scenario to show how it could go. It is not a real case.

Priya is at an airport and sees a Wi-Fi network called “Airport_Free_WiFi”. Her phone connects automatically, because last time she used the same name in another airport. A pop-up asks her to “verify” her email address and password to get online. She types them in, and then checks her bank. The page loads slowly and shows a login screen she does not remember, so she logs in again.

What went wrong: the network was a lookalike, her phone joined it automatically, and a fake page collected her details twice. What would have helped: turning off auto-connect, checking the exact network name with airport staff, never entering her email password to join Wi-Fi, using mobile data for banking, and having two-factor sign-in so a captured password alone would not have been enough.

Public Wi-Fi at a glance

Reasonable to do:

• Browse news, maps and general sites over HTTPS.
• Join networks whose exact name you have confirmed with staff.
• Use a reputable VPN if you want an extra layer.

Better to avoid, or to do on mobile data:

• Banking, shopping and anything involving card details.
• Logging in to email or work systems.
• Entering your email address and password to “get online”.
• Clicking through any certificate warning.

If you think you have been targeted

1. Disconnect from the network and switch to mobile data or another trusted network.
2. Do not log in to anything further on the suspect network.
3. Change your passwords from a trusted connection, starting with email and banking, and turn on two-factor sign-in.
4. Check your accounts for activity you do not recognise, and tell your bank if you entered card or banking details.
5. Forget the network on your devices so they do not reconnect automatically.
6. Report it. Tell the venue if it was public Wi-Fi, and find the right agency in your country on our Report a Scam page if money was lost.

Sources

• SecureW2: What is a man-in-the-middle attack? Types and preventionAccessed October 13, 2026
• CISA: Project Upskill, Module 5: Securing your home Wi-FiAccessed October 12, 2026

Published October 13, 2026. We check every claim against the sources above and say clearly when something is advice rather than fact. This guide is general information, not legal or financial advice. Dollar amounts are in US dollars, as reported.