Buenos Aires is a city that runs on its café tables. Within minutes of sitting down in Palermo or San Telmo, most travelers have asked for the WiFi password, opened a map, and pulled up a boarding pass or a banking app. The overwhelming majority of those networks are exactly what they claim to be. The risk is the small fraction that are not: with a laptop and an inexpensive portable router, anyone seated nearby can broadcast a network that looks identical to the café's real one, and quietly place themselves between you and everything you do online.
One honest note on sources: the UK Foreign Office's travel advice for Argentina does not warn about fake WiFi hotspots specifically. Its crime guidance for Buenos Aires concentrates on pickpocketing, distraction theft in teams, and phones snatched while being used on the street, and it flags busy visitor areas such as Palermo, San Telmo, Florida Street, and the Retiro bus terminal as places to be particularly cautious. Those same crowded zones are where hotspot scams work best, because the trick depends on volume and urgency rather than technical sophistication. The wireless precautions below are standard digital-security practice, not official guidance; they simply extend the Foreign Office's own principle for your bags to your data: don't trust what you can't verify. For street-level cons, start with our general Buenos Aires scams guide.
The Evil Twin Hotspot on the Café Terrace
An "evil twin" is a rogue network broadcasting the same name as a legitimate one. The operator picks a busy café in a tourist zone, clones the network name, and relies on physics: a router at the next table delivers a stronger signal than the real access point in the back office, so your phone shows full bars on the fake. Once connected, your traffic passes through their device first, and they can serve you any login page they like.
The warning signs are subtle but consistent. Two similarly named networks in your list, differing by a character or two. A network with no password even though staff mentioned one. Certificate errors on sites that normally load cleanly. A captive portal more polished than the café itself. Any of these means disconnecting costs you nothing, while staying connected might cost you plenty.
The fix is old-fashioned: ask staff for the exact network name, character for character, and prefer the password-protected network they hand you. If the name they give you isn't in your list, you're looking at someone else's trap.
The Login Page That Wants Your Email Password
The most common payload of a fake hotspot is a captive portal asking you to "sign in with your email to continue." Some imitate familiar sign-in screens; some promise access after a quick card verification. Nothing about joining a network requires your email password. That field exists for one reason: harvesting.
Here is what most travelers underestimate. Your travel inbox is a skeleton key: itinerary, hotel address, boarding passes, and reset links for nearly everything else, including financial accounts. Someone who owns your email doesn't need your bank password; they can reset it. The Foreign Office describes "express kidnappings" in Argentina, where victims are held and forced to empty their accounts through transfers and ATM withdrawals before being released. A harvested inbox can aim at the same prize without the criminal leaving their chair. That parallel is our analysis, not an FCDO warning, but it explains why a WiFi login page deserves the caution you'd give a stranger offering to hold your passport.
Defend the inbox before you fly: a password used nowhere else, plus two-factor authentication through an authenticator app. Never type email credentials into a page that appeared the moment you joined a network.
The QR Sticker Over the Real Menu Code
Restaurants across Buenos Aires use QR codes for menus and WiFi access, and a sticker slapped over the legitimate code turns the table into a phishing page. Scan the fake and you land on a clone site asking you to register for the network with your name, email, date of birth, or card details to unlock a "discount." The Foreign Office doesn't address QR codes in its Argentina advice; this is a pattern seen in tourist cities generally, which we cover in our QR code scams guide.
Inspect before you scan. A sticker layered on another sticker, or curling at the edges, is a red flag. If the link preview shows a domain unrelated to the restaurant, stop. If anything in the flow asks for a card, it isn't a menu. The simplest defense: ask the waiter for the password or a physical menu, and type the restaurant's own web address yourself.
The Arrival Hall Hotspot and the Taxi Add-On
Your most exploitable hours in any country are the first ones: you're tired, your phone may not have local data, and you don't know what the legitimate network is called. That's why generic open networks with plausible names flourish around airports and bus terminals. The Foreign Office specifically lists the Retiro bus terminal among places to be cautious in Buenos Aires, and its transport advice is direct: book taxis in advance where possible, and if hailing one, use only a radio taxi with a clearly visible door logo.
Fake hotspots have learned to fold transport cons into the connectivity con. A portal offering "official taxi booking" that collects your card details solves your ride and your robbery in one form. Treat any WiFi page that wants payment as hostile by default. Better, sidestep it: activate an eSIM or roaming before landing so arrival WiFi is never a necessity, arrange your first transfer in advance, and if you must connect, use only the network name printed on official signage, never one recommended by a person. Our airport WiFi scams guide covers these mechanics in depth.
Session Hijacking on Open Networks
Not every rogue network bothers with a login page; some simply watch. On an open network, an attacker between you and the internet can in some circumstances capture the session tokens that keep you logged in to websites, or intercept traffic that isn't encrypted. Much of the web now defaults to encrypted HTTPS, shown as the padlock in your address bar, but captive portals, older apps, and misconfigured sites still leak.
Treat certificate warnings as stop signs, not "proceed anyway" prompts. Update your operating system and apps before the trip, since updates patch exactly these weaknesses. Use a reputable VPN on any open network so all traffic is wrapped in one encrypted tunnel, and keep banking off shared WiFi entirely; if you must check a balance, use your bank's official app over cellular data.
How to Protect Yourself
- Get the network name from staff. A network the café can't name isn't theirs. Ask for it character for character, along with the password.
- Bring your own data. An eSIM activated before departure, or a SIM from an official carrier store, removes the urgency that makes these scams work.
- Lock down auto-join. Turn off automatic joining, and forget networks after you leave. Your phone can't be lured by a name it doesn't remember.
- Use a VPN on open networks. It won't stop you typing a password into a fake form, but it neutralizes the interception side of the attack.
- Segment your credentials. A unique email password plus app-based two-factor authentication stops one harvested password from cascading everywhere.
- Guard the device, not just the data. The Foreign Office warns that phones are snatched while in use on the street and advises keeping bags off the backs of chairs. The phone holding all your active sessions deserves the same care, especially in the crowded areas it flags, like Palermo, San Telmo, and Florida Street.
- If you think you fell for it: disconnect, switch to cellular, change your email password first, then check the account's forwarding rules and active sessions, then contact your bank. Order matters; the inbox is the master key.
FAQ
Is hotel WiFi in Buenos Aires safe?
Generally lower risk than a random hotspot, but still a shared network. Confirm the exact network name at reception and apply the same rules you would at a café.
I entered my email and password on a suspicious login page. What now?
Disconnect, switch to cellular, and change that email password immediately. Review forwarding rules and active sessions, revoke anything unfamiliar, then change any account that shared the password and alert your bank if card details were involved.
How do I report a scam in Buenos Aires?
The Foreign Office lists the Buenos Aires Tourist Police ("Comisaría del Turista") at +54 911 5050 9260, available 24 hours, with the same number on WhatsApp. You can also file a police report online through the Buenos Aires Police website, though the FCDO notes it is only accessible from within Argentina. In an emergency, call 911.
Should I avoid public WiFi entirely?
No need to be that strict. With a verified network name, a VPN, and segmented passwords, casual browsing on public WiFi is a manageable risk. Reserve real caution for logins and payments.
Buenos Aires rewards travelers who engage with it, and staying connected is part of that. A few habits built before you land let you use the city's networks without handing over the keys to your digital life.
Stay ahead of travel scams — bookmark avoidtravelscam.com and check our destination guides before your next trip.