It's a genuinely simple trick. Someone sets up a Wi-Fi network with the same name as the cafe's real one, sometimes with a laptop and nothing more exotic than that, and waits for phones and laptops to connect automatically. Security researchers call it an "evil twin" network.
Why it's so easy to fall for
Most devices are set to rejoin networks they've used before without asking, which is convenient right up until a fake network borrows a familiar name. Once connected, whoever set it up can potentially see the traffic passing through, including anything not otherwise encrypted.
The network doesn't have to look suspicious. It just has to have the right name.
What actually helps
Confirm the exact network name with staff rather than picking the first one that looks right, especially if you see two similar names. Avoid logging into anything sensitive, banking especially, on public Wi-Fi at all. A VPN adds a genuine layer of protection here specifically, since it encrypts the connection regardless of which network you've landed on.
Related reading
More on when a VPN is actually worth using in this post.