Is someone using your Wi-Fi without permission?

No UK law is written specifically about Wi-Fi. Two broader laws are the ones that come up.

We found two reported UK incidents, both from BBC News and both many years old:

• 2005, Ealing, west London. The BBC reported that a man who used a local resident's wireless broadband from a laptop in his car was prosecuted under the Communications Act and found guilty of dishonestly obtaining an electronic communications service. He was fined £500 and given a 12-month conditional discharge (a 2005 court outcome). The BBC said it was believed to be the first case of its kind in the UK, and that he was believed to have been reported to police by a neighbour who thought he was acting suspiciously.
• 2007, Chiswick, west London. The BBC reported that a man was arrested after Police Community Support Officers saw him using a laptop outside a house. He admitted using someone else's unsecured Wi-Fi and was bailed pending further inquiries. The article doesn't report what happened next.

We haven't checked for later cases, so don't read these two as a guide to how often, or how rarely, it's prosecuted today.

Set the criminal law aside for a moment. Whoever is actually using your Wi-Fi, the broadband contract is in your name, and providers' terms are written with that in mind. Three examples from terms we read in October 2026:

• BT holds the account holder answerable for everyone at home and every device on the home network, and expects anyone sharing a connection to keep out people they haven't allowed on.
• Virgin Media asks customers to secure their router with the encryption it specifies and warns: "Unsecured Wi-Fi connections could lead to you being held legally responsible for misuse on your account by a third party."
• Gigaclear's residential terms don't make your responsibility depend on whether you said yes, and tell customers to give Wi-Fi access only to people they trust.

The rules work in your favour as well. BT forbids its customers from hacking anyone's network, and Virgin Media forbids getting round another network's security or probing it without the owner's express authorisation. A neighbour who cracks your password is breaking their own provider's rules, whatever the criminal law makes of it.

What they do online is traced to your connection first. Websites and rights holders see an IP address (the number that identifies your connection online), not the person at the keyboard. In Golden Eye v Telefonica in 2012, a High Court case in which a film company sought the names and addresses of O2 customers it accused of sharing films, the court accepted that the subscriber may not be the person responsible: it could be someone outside the household using an open or weakly encrypted router. That may help if you're ever wrongly blamed, but you would still have the job of explaining yourself. Our guide to copyright warning letters about your broadband covers what to do if one arrives.

Letting someone on deliberately is a different matter with its own rules; see our guide to sharing your broadband with neighbours or lodgers.

The reliable way is the device list in your provider's app or your router's settings page. Our guide to seeing what's using your broadband shows where to find it for each main provider and how to work out which entry is which. Two warnings before you start:

• Rule out your own kit first. A device can show up under its manufacturer's name or a default name the maker gave it rather than anything you'd recognise; the eero app, for example, labels unknown devices by maker. Phones add to the confusion: Apple devices identify themselves to each network with a different, private Wi-Fi address and may change it from time to time, and Android 10 and later uses a randomised address by default. Your own iPhone can look like a stranger.
• A slow connection isn't proof. Streaming, updates and backups on your own devices slow things down too, so check the list rather than guessing.

Do these in order. The admin password comes first because the router's settings page is where the Wi-Fi password is set, so anyone who can open it can change your new one. Our guide to securing your home router and Wi-Fi goes into each setting in more depth.

1. Make a note of what you found. A dated screenshot of the device list helps if you later need to explain things to your provider or the police.
2. Block or pause the device for now, if you can. Some provider apps and hubs let you cut off a single device. Virgin Media's Connect app lets Hub 3, 4 and 5 customers pause Wi-Fi to individual devices, and BT's access controls can block a specific device's internet access by time and day. A block only covers that one device, though; anyone who knows the password can join on another, so carry on with the next steps.
3. Change the router's admin password. This is separate from the Wi-Fi password, and the default is often printed on the router too. The National Cyber Security Centre (NCSC) recommends combining three random words to make a password that's long and strong but still memorable.
4. Change the Wi-Fi password. Use something new that you don't use anywhere else; Virgin Media specifically advises against making it the same as any of your other passwords. Every device disconnects, including the one you're worried about, and you reconnect your own with the new details. Where to do it depends on your hub: BT points customers to the My BT app, EE to its app or the hub page at 192.168.1.254, Virgin Media to its app or 192.168.0.1, and TalkTalk to the router settings, using the login on the router's sticker. Our router security guide links to the main providers' official instructions; for anyone else, start from our UK broadband providers hub.
5. Check the security setting. Apple recommends WPA3 Personal, or WPA2/WPA3 Transitional if you have older devices, or WPA2 Personal (AES) if neither is available. Avoid WEP and TKIP, and never leave the network open. Apple also lists WPA/WPA2 mixed modes and the original WPA Personal as weak settings to avoid, says hiding the network name doesn't secure it, and says MAC address filtering (letting only listed devices join) shouldn't be relied on, partly because MAC addresses can easily be copied or changed.
6. Turn off what you don't use. US consumer advice from the Federal Trade Commission suggests turning off remote management, UPnP and WPS (Wi-Fi Protected Setup), the push-a-button shortcut for joining without typing the password. The NCSC gives similar advice for smart devices: switch off remote access if you don't need to reach them away from home. Our router remote management explainer covers that setting.
7. Keep the router updated. Apple recommends setting the router to install firmware (its built-in software) updates automatically if it can, and the NCSC gives the same advice for smart devices.
8. Give visitors a guest network from now on. A guest network gives people internet access but not access to your home network, with its own password that's different from your main one. Next time someone asks, you share that instead.
9. Check the list again over the next few days. Anything you don't recognise after the change deserves a closer look.

Reconnecting smart devices is the fiddly part. If a camera or plug refuses to rejoin, our help for smart devices that won't reconnect walks through it, and noting the new passwords somewhere safe saves a hunt later (if that fails, see how to find a forgotten Wi-Fi password).

Usually, changing the passwords is the whole answer: anyone using the old one is cut off, and nobody needs to fall out over it.

Be careful about accusing anyone. A name in your device list isn't proof of who was using it: names can come from the device's maker or be set by its owner. A calm "we've changed our Wi-Fi password" avoids an argument you can't win on the evidence.

Things are different if you think someone has got into your router's settings or your devices, or if you've lost money. The NCSC's advice for anyone who thinks they've been a victim of fraud or cyber crime is to report it to Report Fraud in England, Wales and Northern Ireland (reportfraud.police.uk, or 0300 123 2040), or to Police Scotland on 101 in Scotland. Your screenshots and notes from step 1 are useful here. Be wary, too, of anyone who calls out of the blue offering to "fix" a hacked router: our guide to broadband scam calls and emails covers the common tricks.

If you've been relying on a neighbour's connection, the straightforward fix is to ask. With their permission, you're no longer taking something they haven't offered. Bear in mind that their provider's terms may not allow sharing with another household, and that they're responsible for what you do on it; our guide to sharing broadband with neighbours explains why, and suggests options such as a separate guest network.

If the real reason is cost or availability, your own connection may be closer than you think. You can compare deals at your postcode, look at cheap broadband deals, or read our guide to broadband social tariffs, which explains the lower-priced packages some providers offer and who can get them.

If your router only offers WEP or the original WPA, can't be updated, or has no way to run a guest network, a newer one will make every step above easier. Start by asking your current provider: our guide to getting a newer router from your provider covers how.

Hubs and apps differ in how much control they give you over individual devices (BT's hubs, for instance, offer the access controls mentioned above; our BT broadband deals page has more on BT), so it's worth asking about when you next choose. You can compare deals at your postcode using our partner's comparison tool; it shows deals, and the choice and the sign-up are yours. If you do move, One Touch Switch means you only contact the new provider. Your current one must then send you the switching information, including any early termination charges.