When someone uses your hotspot without you knowing, nothing dramatic usually happens. What happens is that your data allowance — the mobile data included in your plan — runs out a few days early, your battery does not last as long, and your laptop’s connection slows down just as you are trying to work.
This post brings together the signs that devices you have not authorised may be connected to your hotspot: what they mean, where you can see them, and what to do when you find one. In technical circles they are called indicators of compromise, or IOCs (Indicators of Compromise): traces suggesting that someone got in where they should not have. A hotspot, for anyone who rarely uses one, is the phone feature that turns your mobile data connection into a small Wi-Fi network that other devices can join.
It is the diagnostic deep dive on the recommendation about your mobile hotspot password: setting a strong one and changing it regularly is the prevention; recognising the signs is how you find out whether that prevention is working.
What indicators of compromise mean for a hotspot
An indicator of compromise is an observable trace suggesting that something did not go the way it should have.
It is not proof. It is a signal that deserves a check. A device you do not recognise may be the family tablet with an unhelpful name, or it may be the phone of someone who has known your password for months and joins automatically whenever they come within range.
With a hotspot, the indicators are few and simple to read. Their value lies in timing: noticing early means closing the door before it turns into a used-up data plan, or other people’s traffic going out through your connection.
A hotspot password has one feature that sets it apart from account passwords: you give it to other people. To a colleague on the train, to a friend on holiday, to a relative’s child who needs to finish their homework.
And devices remember it. Anyone who has joined once will usually rejoin on their own whenever your hotspot is on and their device is close enough. A password handed over for one afternoon, if it is never changed, stays valid for years.
That is why the signs are best read with one question in mind: how many people have I given this password to, and how long is it since I changed it? The vaguer the answer, the more attention each clue deserves. It is also why recommendation R14 asks for a password that is strong, so it cannot be guessed, and changed often, so the one you shared in the past stops working.
Technical indicators
These are the ones your phone records and shows in the hotspot settings or in its mobile data statistics. Depending on the operating system, you may see a list with the name of each device, or just the number of active connections.
| Indicator | What it means | Why it matters | Where you see it | What to do |
|---|---|---|---|---|
| More connected devices than you authorised | Someone besides you and the people you gave the password to is using the network | It is the most direct sign of access you did not plan for | Hotspot settings, notification or hotspot-active icon | Change the hotspot password: everyone is disconnected and only those who receive the new one can rejoin |
| Device names you do not recognise | A name appears in the list that you cannot match to any of your devices | It may be an outside device, or one of yours with a generic name | List of connected devices | Disconnect your own devices one at a time first: whatever is left, and cannot be explained, should be shut out by changing the password |
| Unknown hardware addresses | A MAC address — the code that identifies a device’s network card — appears that does not match yours | It helps you tell apart two devices with the same name | Connected device details, where the system shows them | Compare it with the address shown in the Wi-Fi settings of your devices; if it does not match, change the password |
| Spikes in shared traffic | The statistics show much higher hotspot usage than usual | Someone else may have used your data | Data usage statistics, entry for the hotspot or connection sharing | Compare it with what you did on those days; if it does not add up, change the password and lower the maximum number of devices |
| Traffic at times you were not using it | Shared data appears on hours or days when you had connected nothing | It shows the hotspot was on and someone was using it | Daily usage statistics, if your phone offers them | Turn on automatic switch-off when no devices are connected |
| A device that reconnects straight away | After you remove it, the same device reappears within seconds | It has the password saved and joins automatically | List of connected devices | Removing it is not enough: change the password, as that is the only way to really shut it out |
| Hotspot settings that have changed | The network name, password or protection level are not what you remember | Someone may have had your phone in their hands, or the network was left unprotected | Hotspot settings | Set a strong password again and check that protection is not set to “none”; check your phone’s screen lock too |
On the protection level: WPA2 and WPA3 are types of network encryption, the way traffic is made unreadable to anyone without the password. The subject will have its own recommendation, R15; for now it is enough to know that “no protection” should never be left switched on.
Signs you can observe yourself
These do not require you to open any menu: you notice them simply by using your phone and laptop as you normally would.
| Signal | What it means | Why it matters | How you notice | What to do |
|---|---|---|---|---|
| Data allowance running out early | You have used more data than you remember | Someone may have been sharing your connection for a while | Usage alert from your mobile provider, connection slowing towards the end of the month | Check the hotspot statistics and connected devices; if something looks wrong, change the password |
| Battery draining faster | The hotspot is working harder because it is serving more devices or more traffic | It is an indirect clue, useful only alongside the others | Shorter battery life on days when the hotspot stays on | Check how many devices are connected; turn the hotspot off when you do not need it |
| Slow connection on your devices | The bandwidth is being split between more users | Anyone extra who is connected takes speed away from you | Pages loading slowly, video calls dropping | Look at the list of connected devices before blaming the signal |
| Your laptop cannot connect | The maximum number of devices has been reached | The places are taken by other devices | Error message, or a connection that will not start with the right password | Check the list: if the places are taken by devices you do not recognise, change the password |
| Hotspot “in use” when you have connected nothing | The phone shows an active connection | Someone has joined automatically | Icon or notification in the status bar, phone warm with the screen off | Open the settings and check who is connected |
| Someone knows the password though you never gave it to them | The password is circulating beyond the people you told | You no longer control who can get in | Someone mentions it, or you find it in a group chat | Change it: there is no need to work out how it got there |
| Extra charges or data-exhausted alerts | Your mobile provider reports usage beyond your plan | The financial effect of prolonged outside use | Text message or email from your provider, an extra item on your bill | Compare with the hotspot statistics and deal with the password |
A concrete example
Sarah has just moved house and, until her home broadband is connected, she works using her phone’s hotspot. On the first day she helps her neighbour across the hall, who urgently needs to send a document: she reads out her hotspot password, the same one she has used for two years.
Three weeks later, her data allowance runs out on the eighteenth day of the month. Sarah puts it down to video calls. Then she notices her phone is warm on the table while she is only reading, and that her laptop sometimes cannot connect.
She opens the hotspot settings: three devices connected. One is her laptop, one her tablet. The third has a name made of letters and numbers. She removes it, and a few seconds later it reappears.
There is no attack. There is the tablet belonging to her neighbour’s son, which saved the password and joins on its own whenever he is at home. Sarah changes the password, reconnects her two devices and sets the maximum to two. The following month, her data lasts until the end.
Each signal, on its own, had a harmless explanation. Together, they told a story.
What to check right away
In the hotspot settings
- how many devices are connected right now, and which ones;
- the network name: make sure it does not include your full name or other personal details;
- the protection type: make sure it is not set to “none”;
- the maximum number of devices allowed, if your phone lets you set one;
- automatic switch-off when nobody is connected.
In your mobile data statistics
- how much traffic has gone through the hotspot in the last month;
- whether there are days with spikes you cannot explain.
In your own memory
- who you have given the password to, and how long it is since you changed it. If you cannot piece that together, the practical answer is already clear.
If you find a suspicious indicator
- Change the hotspot password. It is the step that solves almost everything: every connected device is shut out and only those who receive the new password can rejoin. To choose it well, the same principle applies as for sixteen character passwords: length matters more than symbols.
- Reconnect only your own devices, one at a time, so you know for certain what is on the list.
- Lower the maximum number of connections to the ones you actually need.
- Turn on automatic switch-off for the hotspot when it is not in use.
- Check your usage over the following days, to confirm that traffic is back to normal.
The full sequence, covering prevention, response and recovery, is in the post on how to secure your hotspot. If instead you want to understand what makes unauthorised access possible, you will find the mechanisms explained without jargon in the post on attacks on mobile hotspots.
What is not an indicator
Telling the difference helps you avoid two opposite mistakes: worrying over nothing, and getting used to ignoring the real signals.
| Situation | Why it is usually not a signal |
|---|---|
| One of your devices appears with a different address than usual | Many systems use a random private address for each network, and sometimes renew it: it is a privacy feature, not an intruder |
| A generic name, such as the device model | Many devices present themselves with their factory name until you change it: check your own first |
| Battery dropping while the hotspot is on | A hotspot uses power even with a single device connected: it only counts if the drop is much faster than usual |
| High usage on the day your laptop updated | Many laptops download updates and sync files over a hotspot just as they do at home |
| Slowness on a train, in a tunnel or in the countryside | A weak mobile signal slows everyone down, even with nobody else connected |
The rule of thumb: one isolated signal deserves a look at the list of connected devices; two signals together deserve a new password.
How often to check
You do not need a demanding routine. You just need one to exist, tied to the moments when you actually use your hotspot.
| Frequency | What to check |
|---|---|
| Every time you turn the hotspot on | A glance at the number of connected devices: it takes a few seconds |
| After sharing it with someone | Change the password as soon as the sharing is no longer needed |
| At the end of the month, or when the usage alert arrives | Hotspot usage statistics, compared with how you actually used it |
| Every 2–3 months | Password, network name, protection type, device limit |
| When you change phones | That the hotspot settings have not gone back to factory defaults |
Tying the check to something you already do works better than any good intention.
Two important warnings
An indicator is not proof. An unknown device may be yours, with a name you had forgotten. High usage may come from an update. Check before drawing conclusions — but always check.
No indicators is not a guarantee. Someone who joins briefly and uses little data may leave no obvious traces. That is why protection rests on prevention: a long, unique password, changed regularly and after every time you share it, and the hotspot switched off when you do not need it. Indicators help you act quickly; they do not decide whether protecting yourself is worth it.
How this connects to the Cyber Welfare Framework
| Pillar | What this content contributes |
|---|---|
| Skills | Knowing how to read the list of connected devices and the usage statistics, and interpret what they show |
| Awareness | Understanding that a shared password stays valid until you change it, even for someone who received it only once |
| Secure Behaviour | Checking connected devices every time the hotspot is turned on, without waiting for the data to run out |
Reference level: FL3 — Autonomous. This is the level at which you recognise a signal and act on it without needing outside support.
Conclusion
Spotting unknown devices on your hotspot does not mean eyeing your phone with suspicion. It means knowing where to look, so that a vague annoyance becomes a question with an answer.
What to do right now. Next time you turn on your hotspot, open the list of connected devices. If there is something you do not recognise, change the password: it takes a minute. If everything looks fine, you now know how quick that check is. To see where you stand on the other aspects of your digital security too, you can take the digital resilience self-assessment.
Related resources
Short deep dives from the Resources section, for anyone who wants to focus on a single aspect:
- Home Network Attack Surface: Counting What Is Connected
- Wi-Fi Security: When a Connection Is Safe Enough
Related content
- Mobile hotspot password — the recommendation this belongs to
- Attacks on mobile hotspots — the mechanisms that generate these signals
- How to secure your hotspot — what to do, in the right order
- Mobile hotspot risks — what gets hit when a signal is confirmed
Start with the first step: the Cyber Welfare Programme guides you free of charge, one recommendation at a time.
