Juice Jacking Guide: Public Charging Risks, Real Threats and Practical Advice

Juice jacking is an attack in which a tampered public USB charging port or cable is used to read data from, or install malware on, a phone or tablet while it charges. It works because the same USB connector carries both power and data. Government agencies have warned the public about it and researchers have shown it is technically possible, yet the US Federal Communications Commission says it is not aware of confirmed real-world cases. This guide explains the threat in plain language, separates demonstrated research from reported incidents, describes the protections built into iOS, iPadOS, macOS and Android, and gives practical advice and policy settings for travellers and the security teams that support them.

Key takeaways

• Power and data share one port: a USB connection can carry data unless the device, cable or an adapter prevents it, so an untrusted port is an untrusted computer.
• Real but rarely reported: the FCC describes juice jacking as a demonstrated proof of concept and says it knows of no confirmed real-world instance. Treat it as a low-likelihood, easily avoided risk, not a reason for alarm.
• Operating systems now gate data: iPhone and iPad need to be unlocked and the user to trust the computer before data flows, Apple silicon Mac laptops ask before new accessories connect, and Android defaults USB to charging.
• Prompts are not a perfect barrier: the 2025 ChoiceJacking research showed a malicious charger could spoof user input to approve its own data connection on devices from eight vendors, and vendors acknowledged it.
• The fix is cheap: use a wall plug and your own charger, a power bank or a charge-only cable or data blocker, choose "charge only" if prompted, and keep devices updated and managed.

What it is

Put simply: when you plug a phone into a USB port, you are connecting it to whatever computer sits behind that port. A normal charging kiosk only supplies power. A tampered one could hide a small computer that tries to talk to the phone over the data wires, to copy photos and files or push software onto it. The term "juice jacking" was popularised by security journalist Brian Krebs in 2011, and MITRE ATT&CK for Mobile records the technique under T1458 Replication Through Removable Media, which describes adversaries using a connection to a compromised or malicious charging station or PC to install apps or access data on a device.

The FCC's consumer guidance describes the same picture: criminals may load malware onto public USB charging stations in places such as airports and hotel lobbies, and malware installed this way can lock a device or export personal data and passwords that are then used to access accounts or sold. The attack can also be delivered through a cable left plugged into a kiosk or handed out free, because a cable can contain electronics too.

How it works

USB was designed for both power and data. When a phone is connected, the two ends negotiate what the link is for. A juice jacking setup hides a computer or a modified controller behind the port and tries to turn a charging session into a data session.

• Data access: if the device trusts the host, the host can use the same mechanisms a laptop uses to sync or back up a phone. Apple states that a trusted computer can sync with an iPhone and access photos, videos, contacts and other content, and that trust persists until it is reset or the device is erased.
• Software installation or exploitation: on older or misconfigured devices, a host may push an app or exploit a weakness in the USB stack. ATT&CK T1458 cites examples such as insecure bootloaders exploited over USB on specific older Android models.
• Debug interfaces: Android's USB debugging (in Developer options) lets SDK tools communicate with the device, so leaving it enabled widens what a malicious host could attempt. It is off by default.
• Spoofed approvals (ChoiceJacking): researchers at Graz University of Technology presented "ChoiceJacking: Compromising Mobile Devices through Malicious Chargers like a Decade ago" at USENIX Security 2025. Existing defences assume a charger cannot inject input while the data connection is being approved. The authors showed that a cheap custom charger can spoof user input to approve its own data connection on Android and iOS, gaining access to files such as pictures, documents and app data on all tested devices from eight vendors, including the top six by market share. For two vendors files could be extracted from locked devices. Google, Samsung, Xiaomi and Apple acknowledged the findings and were reported to be integrating mitigations.

The practical lesson from ChoiceJacking is that a confirmation prompt is a useful control but not a complete one: preventing the data connection physically (wall charger, power bank, charge-only cable) removes the attack class, and keeping devices updated picks up vendor fixes.

Built-in protections

Why it matters

For most people the honest answer is that juice jacking is unlikely, and simple habits remove it. It matters in three situations. First, high-value travellers (executives, journalists, officials, engineers with privileged access) are worth a targeted effort, and phones carry authenticators, passkeys, messaging history and corporate data. Second, the same technique works through any untrusted USB host, including hire-car head units, hotel televisions and shared laptops. Third, the public advisories (the FBI's widely reported 2023 warning and the FCC's consumer guide) mean staff will ask the security team about it, so a clear, factual position avoids both complacency and panic.

Advice for individuals

1. Prefer a wall socket with your own charger, or a car charger, and carry your own cable.
2. Carry a power bank and charge it, not your phone, at public ports.
3. Use a charge-only cable or USB data blocker from a trusted supplier when a USB port is the only option.
4. Never use cables left at kiosks or free giveaway cables.
5. Answer prompts conservatively: choose "charge only" or "Don't Trust" if asked to share data or trust a computer, and do not unlock the phone while it is connected to an unknown port.
6. Keep the device updated, because vendor mitigations for ChoiceJacking-style issues arrive through OS updates.

Policy for organisations: implementation steps

1. Set a position: include public charging in the travel and mobile device policy, rated low likelihood, with the habits above as the standard. See the Mobile Device Security Guide and the BYOD Policy Template.
2. Issue the kit: give frequent travellers a plug charger, a power bank and a labelled charge-only cable. This costs little and removes the decision at the airport.
3. Enforce through MDM: on supervised Apple devices set Wired Accessories to Ask for New Accessories or Always Ask for high-risk users; on managed Android devices block USB file transfer and USB debugging. Pilot with a small group first, because stricter settings affect docks, CarPlay and wired headsets.
4. Raise the bar for high-risk travel: loaner devices for high-risk destinations, minimal data on them, and a wipe and reimage on return.
5. Roll back where needed: if stricter accessory settings break legitimate workflows, relax them per group rather than fleet-wide.
6. Brief staff in plain terms: one paragraph in travel briefings, framed as habit rather than fear. See the Security Awareness and Human Risk Management Guide.

Detection and metrics

• What to monitor: MDM compliance for OS version and USB restriction profiles, mobile threat defence alerts for unknown apps or profiles, and reported suspicious kiosks or cables.
• Share of managed devices on a supported, current OS (target above 95%).
• Share of high-risk users with USB accessory restriction profiles applied.
• Share of frequent travellers issued a charging kit.
• Devices with USB debugging enabled in the managed fleet (target zero outside development).
• Loaner device wipe completion after high-risk trips.

Common misconceptions

• "Juice jacking is happening everywhere." The FCC describes it as a demonstrated proof of concept and is not aware of confirmed real-world cases. Overstating it erodes trust in the security team.
• "It is a myth, so nothing needs doing." Research keeps finding gaps, ChoiceJacking being the 2025 example, and the protections cost very little.
• "The Trust prompt makes me safe." It helps, but ChoiceJacking showed input can be spoofed, and users approve prompts out of habit. Removing the data path is stronger than a prompt.
• "Any short cable is charge-only." Many cables carry data, and a cable can contain electronics. Use one sold and labelled as charge-only, from a trusted supplier.
• "Only USB-A kiosks are a risk." The threat follows any untrusted USB host, including USB-C ports, cars and shared computers.
• "Locking the phone is enough." Locked-device rules help, but the research found two vendors' locked devices could still leak files, and people often unlock phones while charging.

Related concepts

• Malicious USB devices and cables: the same risk on laptops, covered with device control in the Removable Media and USB Control Guide.
• Mobile malware: what a successful install can do. See the Mobile Malware Guide.
• Wireless risks while travelling: the FCC pairs juice jacking advice with caution about public Wi-Fi. See the Bluetooth, RFID and NFC Security Guide.
• Physical access to devices: lock-screen bypass (ATT&CK T1461 Lockscreen Bypass) and theft. See the Tailgating and Piggybacking Guide for the building-level equivalent.

Framework mapping

Practitioner checklist

• Publish a factual position on public charging in the travel and mobile policy, citing the FCC guidance.
• Issue plug chargers, power banks and labelled charge-only cables to frequent travellers.
• Apply MDM profiles restricting wired accessories on supervised Apple devices for high-risk users.
• Block USB file transfer and USB debugging on managed Android devices outside development roles.
• Keep the fleet on current OS versions so ChoiceJacking-style mitigations land.
• Use loaner devices with minimal data for high-risk destinations and wipe them on return.
• Teach "charge only" and "Don't Trust" as the default answers to USB prompts.
• Track OS currency, profile coverage and kit issue as the programme metrics.

Standards and references

• FCC: Juice Jacking, Tips to Avoid It
• USENIX Security 2025: ChoiceJacking: Compromising Mobile Devices through Malicious Chargers like a Decade ago
• Apple Support: Allow USB and other accessories to connect to your iPhone or iPad
• Apple Support: About the Trust This Computer alert on your iPhone or iPad
• Apple Support: Allow accessories to connect to a Mac laptop
• Android Developers: Configure on-device developer options
• MITRE ATT&CK: Replication Through Removable Media (Mobile)
• NIST: SP 800-53 Rev. 5 Security and Privacy Controls

Related NHI Mgmt Group resources: Mobile Device Security Guide · Removable Media and USB Control Guide · Mobile Malware Guide · Mobile Threat Defense Buyer's Guide