[JohnFen]

> (Also these WiFi offload networks are secure; you can’t spoof them)

How do we know this? What's the security mechanism?

[seraphsf]

Hotspot 2.0, a.k.a. Passpoint. Within that standard, the phones, WiFi networks, and carriers are all using EAP-AKA or EAP-SIM authentication.