Public USB Charging: What Your Phone Shares When You Plug In

Additional resource for the lesson “USB Charging Safety in Public Places” — Online Privacy course

A USB cable carries two things: power for your battery and, potentially, data from your phone. Public USB charging points at airports, stations and hotels are usually just a convenience, and this resource keeps the risk in proportion. It shows you what your phone can share with whatever is at the other end of the cable, which prompt decides it, and how to charge on the move without having to think about it.

A. Why this matters

Most of the time, privacy questions are about apps and accounts. This one is about a socket. When you plug a phone into a USB port, you are connecting it to a small computer you cannot see, and computers can do more than supply power.

In privacy terms, the question is the one this course keeps returning to: what is known about you, and by whom. A phone that shares data with a charger, a laptop or a car could share your photos, your videos and your contacts. Your phone does not do this silently. It asks, and the answer is a privacy decision as much as a technical one.

There is no need for alarm. The sources below show that the attack is possible and that confirmed cases are hard to find. A small habit is enough.

What the sources say

The idea is not new. In 2011 the journalist Brian Krebs reported on a charging kiosk that researchers set up at DEF CON, a security conference, to show that a public charger “could be configured to read most of the data on your phone”. They took no data, but at least 360 attendees plugged in. One researcher explained that, at the time, most smartphones were set up “to just connect and dump off data”.

In the United States, the Federal Communications Commission (FCC) describes “juice jacking” as malware loaded onto public USB charging stations, such as those in airports and hotel lobbies, which can lock a device or export personal data and passwords. It also keeps the risk in proportion: the technique has been demonstrated as a proof of concept, but “the FCC is not aware of any confirmed instances of it occurring.”

Phones have changed since 2011. Researchers at Graz University of Technology note that mobile operating systems “introduced user prompts for confirming data connections”. In a 2025 paper they showed that a malicious charger could get round those prompts on all the devices they tested, from eight manufacturers. The manufacturers that acknowledged the findings, including Apple, Google and Samsung, were working on fixes, which is one more reason to keep your phone updated.

The course “Offline Defence” goes deeper into the physical side of this topic: devices, ports and what you carry with you.

B. Key concepts

Six ideas that turn a charging point from a worry into a choice.

One cable, two jobs

A USB cable can carry electricity and data at the same time. A wall socket with your own plug carries only electricity.

Why it matters to you: Once you know the cable can carry data, the question “is this charger safe?” becomes a simpler one: “does this charger need to talk to my phone?” For charging, it does not.

Juice jacking

The name for using a public USB charging point to reach the data on a phone or install malicious software on it. The FCC calls it technically possible and knows of no confirmed cases.

Why it matters to you: Both halves matter. The risk is real enough to deserve a habit, and rare enough that you do not need to worry about every port you have used in the past.

The trust prompt

When you connect an iPhone to a computer or other device for the first time, it asks whether you trust it. On Android, a notification called “Charging this device via USB” appears, and file transfer is something you choose under “Use USB for”.

Apple explains that a trusted computer can “access your device’s photos, videos, contacts and other content”, and that tapping Don’t Trust blocks that access. The FCC’s advice for any prompt offering to share data, trust the computer or charge only is to “always select ‘charge only’”.

Why it matters to you: This is the privacy decision in the whole topic. A public charger or a hotel television has no reason to see your photos and contacts, so the answer is no.

What your phone remembers

Apple notes that “your device will remember the computers you’ve chosen to trust.” A yes given months ago, for one quick transfer, can still stand today.

Why it matters to you: Your trust list is part of the answer to “who can see my data?”. It is worth knowing it exists, and how to clear it.

Charging without data

Three ways to avoid the question altogether: a wall socket with your own plug, a power bank (an external battery you charge at home), or a charge-only cable, which the FCC describes as preventing data from being sent or received while charging.

Why it matters to you: With any of these, there is no data connection to accept or refuse. It is the calmest option because it needs no decision at the charging point.

Updates close gaps

The 2025 research showed that prompts can have weaknesses, and that manufacturers fix them through software updates. The researchers also found that, on most devices, the attack needed the phone to be unlocked at some point during charging.

Why it matters to you: An updated phone that locks itself quickly is harder to reach through a cable, and that protects the same photos and contacts.

C. A practical example: Marco at the gate

Marco is 22, a university student and a gamer. Two moments in one month raised the same question, though only one felt like it at the time.

The first was at a friend’s flat. Marco wanted to copy a few game clips from his phone to his friend’s gaming computer, so he plugged in and tapped Trust without reading the message. The clips copied. The computer could now reach his whole camera roll and his contacts too, and his phone would remember that computer as trusted.

The second was at the airport. His flight was delayed, his battery was at 8%, and a pillar near the gate had a row of free USB ports. He had read a dramatic headline about “juice jacking” and did not know whether to be worried or to shrug it off.

What changed after Marco looked into it

Marco did the exercise below one evening. He was not frightened, just a little more informed:

• He learnt that the airport risk had been demonstrated, but that the FCC knows of no confirmed cases. He felt neither silly for worrying nor careless for having charged before.
• He realised that the moment that mattered more was the Trust he had tapped at his friend’s flat. He did not distrust his friend. He simply had no reason to leave the door open.
• He cleared his list of trusted computers and decided that next time he would read the prompt and choose deliberately.
• He put a small power bank and his own plug in his backpack. At the next delay, he charged from the power bank and left the pillar for others.

He did not stop using USB. He stopped saying yes to data connections he had not asked for.

D. Try it yourself: a charging check before you travel (10 minutes)

Four short steps, best done at home before your next trip, with your phone, your usual cable and, if you have one, your own computer. None of them assumes anything has gone wrong.

Step 1 — See the prompt on your own phone (3 minutes)

• Plug your phone into your own computer and look at the screen.
• On iPhone, notice the “Trust This Computer” alert and its two choices, Trust and Don’t Trust. On Android, swipe down and find the “Charging this device via USB” notification, then look at the options under “Use USB for”.
• Read it once, calmly, so that you recognise it at a public port or in a hotel room.

Step 2 — Look at what you already trust (2 minutes)

• Think of the computers and other devices you have connected to over the past year: friends’ laptops, work machines, cars, televisions.
• On iPhone, Apple’s way to clear the trusted list is Settings › General › Transfer or Reset iPhone › Reset › Reset Location & Privacy. As the name says, it covers more than trusted computers, so read the confirmation on your screen before you tap it, and decide whether to do it now or simply note it for later.
• After a reset, your phone asks again the next time you connect, and you can choose with fresh eyes.

Step 3 — Pack a charging kit (3 minutes)

• Put your own plug and cable where you keep your travel things.
• If you have a power bank, charge it now. If not, consider one for long journeys.
• If you would like a charge-only cable, buy it from a seller you trust and label it, so you know which cable carries data and which does not.

Step 4 — Check for updates (2 minutes)

• Open your phone’s settings and look for a software update.
• If one is waiting, plan to install it on Wi-Fi you trust, with the phone charged.
• While you are in settings, check that your screen locks automatically after a short time.

Once your kit is packed, charging on the move needs no decision at all.

E. Videos, articles and further resources

Institutional sources first, then research, journalism and official platform help pages. All in English.

Institutional sources

Federal Communications Commission (US) — ‘Juice Jacking’: Tips to Avoid It
What juice jacking is, why the FCC knows of no confirmed cases, and practical tips: wall sockets, a power bank, a charge-only cable, “charge only”.
https://www.fcc.gov/juice-jacking-tips-to-avoid-it

Research

USENIX Security Symposium — ChoiceJacking: Compromising Mobile Devices through Malicious Chargers like a Decade ago
The 2025 paper from Graz University of Technology showing how trust prompts were bypassed, and that manufacturers were working on fixes.
https://www.usenix.org/conference/usenixsecurity25/presentation/draschbacher

Journalism

Krebs on Security — Beware of Juice-Jacking
The 2011 article on the DEF CON charging kiosk that showed how much a public charger could read from a phone.
https://krebsonsecurity.com/2011/08/beware-of-juice-jacking/

Platform documentation

Apple Support — About the “Trust This Computer” alert message on your iPhone, iPad or iPod touch
What a trusted computer can access, how to choose Don’t Trust, and how to clear the trusted list.
https://support.apple.com/en-gb/109054

Android Help — Transfer files between your computer and Android device
The “Charging this device via USB” notification and the “Use USB for” choice.
https://support.google.com/android/answer/9064445?hl=en-GB

Links checked in October 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Secure Behaviour pillar at level FL1 – Basic, where the aim is a simple habit that protects your data without needing expert knowledge.

Skills

• Recognising the trust prompt on your own phone and choosing deliberately.
• Clearing the list of computers your phone trusts.
• Checking for software updates and the screen lock setting.

Awareness

• Understanding that a USB cable can carry data as well as power.
• Knowing that juice jacking has been demonstrated, and that the FCC knows of no confirmed cases.
• Seeing a “Trust” answer as a decision about who can reach your photos and contacts.

Secure Behaviour

• Charging from a wall socket with your own plug, or from a power bank, when you are out.
• Answering “Don’t Trust” or “charge only” to any device that only needs to charge your phone.
• Keeping a small charging kit ready, so the safer choice is also the easiest.

G. Questions to sit with

• Which computers or devices might your phone still trust, and would you choose to trust them today?
• When you charge in public, what makes you pick one option over another: habit, convenience or how full your battery is?
• If a charger asked out loud to see your photos, what would you answer?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. Before you travel

• R6 — Keep your software up to date: manufacturers fix weaknesses in USB prompts through updates, and an updated phone is harder to reach through a cable.

Minimum commitment: before your next trip, put your own plug and cable, or a charged power bank, in your bag.

2. At the charging point

• R7 — Set your screen to lock after a few seconds: the 2025 research found that, on most devices, the attack needed the phone to be unlocked at some point during charging.

Minimum commitment: the next time any device asks whether to trust it or share data, read the prompt and choose “Don’t Trust” or “charge only” unless you really want to transfer something.

In short

• A USB cable can carry data as well as power; a wall socket with your own plug carries only power.
• Juice jacking has been demonstrated, and the FCC knows of no confirmed cases: a habit is enough, worry is not needed.
• The trust prompt is a privacy decision about your photos, videos and contacts, and your phone remembers the answer.
• A power bank or your own plug removes the question; updates and a quick screen lock cover the rest.

Related resources in this course

• Public Wi-Fi Privacy: What an Open Network Learns About You
• Password-Protected Public Wi-Fi: What the Password Really Covers
• What Is HTTPS? What the Padlock Tells You, and What It Doesn’t

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.