A phone appearing twice in your router's device list does not necessarily mean an intruder has joined the network. The phone may be using a private Wi-Fi address. A MAC address belongs to a network interface's local-link operation; it is not a permanent identity for a person.
Hardware address and active address can differ
Ethernet and Wi-Fi commonly use 48-bit addresses written as six hexadecimal bytes. For example, 02:11:22:33:44:55 is an illustrative locally administered address. A laptop's wired adapter, wireless adapter and virtual interfaces can have different addresses. Not every interface type, such as a loopback or tunnel, has an Ethernet-style MAC address.
Factory allocation does not guarantee that the same address is always used on the network. Locally assigned addresses, virtual machines and privacy features make “globally unique and impossible to change” an unsafe assumption. A vendor lookup is not proof of ownership and may be unhelpful for randomized addresses. RFC 9724 discusses randomized and changing MAC addresses.
Find the adapter carrying your traffic
In Windows PowerShell, inspect names and status alongside the address:
Get-NetAdapter | Select-Object Name, Status, MacAddress
You can also inspect the physical address for the relevant adapter in ipconfig /all. Do not copy the first entry without checking whether it belongs to Ethernet, Wi-Fi or an unused adapter. Consult the Get-NetAdapter reference for adapter selection.
On Linux with iproute2 installed, display a brief link listing:
ip -br link
On macOS, inspect the active connection in network settings; ifconfig also lists interfaces. Do not assume that Wi-Fi is always named en0. On a phone, check the details of the connected Wi-Fi network before relying on the factory address shown in the device's general information screen. Menu names vary.
What can a remote website see?
In ordinary routed IP communication, a remote website does not obtain your local Ethernet or Wi-Fi MAC address from the IP packet. Link-layer headers are used for delivery on each local link, not carried unchanged through every router. On an IPv4 Ethernet LAN, ARP resolves the local next-hop address. That mapping is not user authentication.
A VPN does not hide the active Wi-Fi MAC address from the access point you joined. Its tunnel operates above that local connection. Similarly, a MAC allowlist is not a substitute for properly configured Wi-Fi authentication: an address should not be treated as an unforgeable credential.
When a reservation stops following the device
A DHCP reservation must match the identifier the server actually uses, which can depend on its MAC-address or client-identifier handling. If a private address changes, an older reservation may no longer match. Apple documents private Wi-Fi address behavior and its network-specific settings.
Keep privacy enabled where practical instead of switching it off globally to tidy a device list. For a managed network, compare the active address, the correct adapter and the server's lease record first. A reservation for the wired adapter will not automatically apply when the same laptop connects over Wi-Fi.