Evil twin hotspots work because they look boringly legitimate, so your defense is verification rather than instinct. The core habit: get the exact network name, spelling and all, from a staff member or official signage inside the venue before connecting. Attackers typically use near-identical names, an added word like Free or Guest, an underscore, or a spelling one letter off, and count on you grabbing the first plausible option in the list.
Warning signs worth acting on: two networks with nearly the same name, especially if the venue's real one has a password and the impostor is open; an open network where staff say theirs requires a password; a login portal asking for card details, passwords to other accounts, or excessive personal data; and certificate warnings from your browser after connecting, which you should never click through on public Wi-Fi.
A few protective settings help too: disable auto-join for open networks, forget public networks after use, and run a VPN so even a successful twin sees only encrypted traffic.