If you are connecting to open networks (that is, without using a PSK and having no encryption), there is no way to verify that the network is the one you think it is. Anybody within range can sniff the traffic as well. ESSIDs can be set to anything, BSSIDs can be spoofed. If you are using any open network for any reason, it is best to secure your traffic inside something like a VPN.
For networks using a variant of WPA* personal, an evil twin attack is not possible unless the attacker also knows the PSK. This is because during the initial handshake, both the access point and client must prove mutual knowledge of the correct PSK. This makes it impossible for the attacker to steal the PSK in plaintext. Of course, there are ways to capture and brute force it, but this is not related to evil twin. If the attacker does already know the PSK (e.g. coffee shop that gives out the PSK publicly), an evil twin attack can be carried out.
There are some evil twin attacks to work around WPA personal networks, by DoS'ing the real network, and setting up an identically-named open network. If the user tries to connect to this network, a webpage pops up that asks for the WiFi password. As long as one is aware that they should only connect to their network when it is WPA-secured and to never input the credentials anywhere else, this shouldn't be an issue.
Unfortunately, WPA enterprise networks sometimes make evil twin attacks even easier. Depending on the 802.1X authentication mechanism and whether the user enables certificate verification, it may be trivial to steal a user's domain credentials in plaintext by using an evil twin.
TL;DR: You cannot trust open networks at all. You can trust WPA personal networks, as long as the PSK is strong and is kept secret from the attacker. You can trust WPA enterprise networks if you and the administrator follow best practices.
*: When I say WPA, you should be using at least WPA2, if not WPA3.