How to tell if a public USB charging station is safe

TL;DR

Public USB charging stations are a real but limited risk. Confirmed in-the-wild attacks at public stations have not been documented in any review we can find, and the EFF called the recurring FBI warnings "zombie scaremongering" in April 2023.^[1] What has been documented, in research papers and at security conferences, is a long series of proof-of-concept attacks, the latest of which is ChoiceJacking, disclosed in 2025 by researchers at Graz University of Technology, which bypasses the consent prompts that Apple and Android show when you plug into a USB port.^[2]^[3] Apple patched the iOS variant in iOS 18.4 and Google patched the Android variant in Android 15, so the prompt is now reliable on a patched, up-to-date device.^[3] Practical defenses, in order of how much they cost you: bring your own wall charger, carry a small power bank, carry a USB data blocker (a "USB condom"), refuse the data prompt if one appears, and only use a public port you have eyeballed for tampering.

What juice jacking actually is, and what it would take

A USB cable has four wires inside it: two for power (VCC and ground) and two for data (D+ and D-). A normal charger only energizes the power pair. A "charging station" that wants to talk to your phone has to energize the data pair as well, and your phone has to accept the connection.

There are three families of attack researchers have demonstrated against phones plugged into attacker-controlled USB ports:

Data theft or malware installation through a normal USB data connection. This is the original 2011 idea, and it requires your phone to accept the data connection. Modern iOS and Android both prompt you before allowing a USB host to read your files or push a command, so a successful attack has to either bypass that prompt or trick you into tapping through it.
Video/screen mirroring capture. Documented in 2016 by researchers at Aries Security and the Wall of Sheep at Defcon. Their "Video Jacking" kiosk recorded the mirrored screen from phones that defaulted to outputting video over USB, including some Android devices using SlimPort or MHL and some iPhones on the Apple Lightning connector.
Keyboard injection, or pretending to be a keyboard. A malicious USB host can present itself as a Human Interface Device (HID) keyboard and type commands into the phone. The lock screen is the main defense here, which is why the EFF's 2023 advice boils down to "lock your phone while charging."^[1]

None of those three families has produced a documented case at a real public charging station. EFF's 2023 review found "no reports of widespread exploitation of USB vulnerabilities in the wild,"^[1] and a 2025 Malwarebytes follow-up said the outlet had not found any new real-world cases since.^[2] The threats are real in the lab. Whether they have ever been used to compromise a traveler at an airport is a separate question, and the honest answer in the sources we could find is no.

How to eyeball a public USB station in seconds

You cannot tell whether a public USB port is benign or compromised by looking at it, because the attacker does not need to modify the cable or the port. A compromised kiosk is a normal-looking USB port that happens to also try to talk to your phone.

What you can check in seconds is whether the port has been physically tampered with, the way you would check an ATM card slot or a public charging cable:

The cable is stuck into the port and cannot be removed. This is the most common legitimate configuration at airports and hotels, but it is also the configuration that gives you zero recourse if the wiring behind it is hostile. Treat permanent cables as if you had no choice about the port.
The plastic around the port is cracked, glued, or has a different color or sheen than the surrounding surface. A skimmer or hidden data tap usually lives in a small box strapped to or behind the port. New plastic on old plastic is the tell.
The port wiggles, sits higher than the ones next to it, or has a seam. Same logic as an ATM skimmer: anything that moves when you push on it was not there when the kiosk was installed.
The USB-A port feels loose or has unexpected depth. A "shell" overlay port that slides over a real port adds a few millimeters and a millimeter of slop. Hard to feel through a phone, but easy to feel with a fingernail.
The cable itself is thicker or stiffer than a normal charging cable. A small attacker box lives somewhere along the cable and adds bulk. The data cables the Wall of Sheep handed out at Defcon were visibly heavier than the ones the convention center installed.

Most of the time you cannot do any of these checks. The cable is captive, the kiosk is across a terminal, and your battery is at 4 percent. The rest of this page is for those moments.

The four defenses, in order of how much they cost you

1. Bring your own wall charger and cable

EFF's April 2023 advice: "Bring your own charger or battery for electrical reasons," and as a bonus it side-steps the entire juice-jacking question because your charger is plugged into mains power, not into a USB host.^[1] A small folding plug and a one-meter USB-C to USB-C cable weigh almost nothing and fit in a jacket pocket. This is the defense that costs you nothing in practice and works against every variant of the attack, including ones that have not been disclosed yet.

2. Carry a small power bank

A small lipstick-sized power bank fully recharges a modern phone and removes the public-port problem entirely. You charge the power bank at home from your own charger, then top up the phone from the power bank on the road. There is no USB data path involved; the power bank only passes current. This is the closest thing to a zero-tradeoff defense and is the one the TSA effectively recommends in its March 2025 Facebook post on the topic.^[2]

3. Carry a USB data blocker (a "USB condom")

A USB data blocker is a small inline adapter that connects the power pins on a USB cable and physically disconnects the D+ and D- data pins. Your phone sees power and nothing else. There is no data path, so there is nothing for a malicious port to talk to.

Two practical caveats:

Most data blockers block fast-charging protocols. Qualcomm Quick Charge, USB Power Delivery, and Apple's fast-charge handshakes all use the data lines to negotiate voltage. A data blocker will fall back to slow USB-A 5 W charging, which is enough to top up overnight but not enough to recover from a near-dead battery in 20 minutes. If you need fast charging from an unknown port, a data blocker is the wrong tool.
Not every "USB data blocker" is wired correctly. Counterfeits exist. Buy from a brand with a published wiring diagram, or open the housing and confirm the data pins are absent before trusting the adapter with your phone.

4. Use the prompt, on a patched device

If you do plug a phone directly into a public port, the operating system is supposed to ask you before any data transfer happens. On iOS this is the "Trust This Computer" prompt and on modern Android the equivalent is a "Charging only" option in the USB connection dialog. Tap "Don't Trust" or "Charging only" and the port becomes a power source.

The reason this is at the bottom of the list and not the top is that researchers at Graz University of Technology in Austria disclosed a new variant in 2025 called ChoiceJacking that bypasses those prompts on unpatched devices. Three variants have been published: one that works against both iOS and Android by spoofing a Bluetooth keyboard, and two that work against Android only by abusing the Android Open Access Protocol or by flooding the input buffer with pre-queued keystrokes.^[3] Apple patched the iOS variant in iOS 18.4 and Google patched the Android variant in Android 15, so on a patched device the prompt is now reliably required and cannot be auto-confirmed by a malicious port.^[3] There is one important caveat: the published reporting notes that Samsung devices running One UI 7 did not always prompt for authentication even on Android 15, so on a Samsung you should test with a trusted PC before you trust the prompt to fire on the road.^[3]

What the FBI and FCC actually said, and when

The juice-jacking conversation has its own cast of recurring characters, and they have not always agreed.

In April 2023 the FBI's Denver field office posted on X that travelers should "avoid using free charging stations in airports, hotels, or shopping centers." The post was a generic warning, not driven by any documented incident. EFF reported that an FBI spokesperson told Ars Technica the field office had relied on a 2019 FCC article, which had itself relied on a 2019 warning from the Los Angeles County District Attorney's office. EFF noted that the LA DA warning "did not itself allege any specific bug or specific instances of charging stations being used for attacks," and that the FCC later "quietly removed the sourcing from its article."^[1]

The term itself is older. EFF traces it to a 2011 Brian Krebs article reporting on a Defcon demonstration by the Wall of Sheep.^[1] A Wikipedia summary of the same period lists the researchers behind that kiosk as Brian Markus, Joseph Mlodzianowski, and Robert Rowley, and the kiosk itself as an awareness demo whose screen warned the user, not an active attack tool.^[4]

What has happened since 2011 is a string of academic and conference demonstrations of related attacks, including a 2013 Mactans presentation at Black Hat USA by Georgia Tech researchers who infected an iPhone through a modified wall charger, and a 2014 BadUSB presentation at Black Hat USA by Karsten Nohl and Jakob Lell of SRLabs who re-flashed the firmware inside a USB device.^[4] Each of these was a controlled research disclosure, not a documented attack on a member of the public.

In March 2025 the TSA posted a Facebook warning that "Hackers can install malware at USB ports (we've been told that's called 'juice/port jacking')," which is the most recent government-facing restatement of the same advice and the prompt that re-ran the story in the press.^[2]

What to actually do at an airport at 4 percent battery

If you forgot your charger and your power bank is dead, here is the order that costs you the least:

Look for a normal wall outlet. Airports, hotels, and most coffee shops have them. A small folding plug solves the problem permanently and costs less than a coffee.
Look for a captive USB cable you cannot remove. Treat it as a hostile port by default, plug in, and watch for any "Trust this computer," "Allow data access," or "Charge only" prompt. If you see one and you can pick "Charge only" or "Don't Trust," do so.
If a prompt appears that you cannot dismiss without granting access, unplug. Do not tap through. The whole point of the prompt is that a malicious host cannot auto-confirm it on a patched phone.
If you absolutely have to charge through a captive cable and cannot see the prompt (older Android on a captive cable that does not offer a prompt at all), consider powering the phone off first. A powered-off phone is not advertising its data endpoint to whatever is on the other end of the cable. You lose the clock, but you also lose the attack surface.

This is not the strongest defense. A power bank is stronger. Your own wall charger is strongest. The point is the hierarchy: own charger beats power bank beats data blocker beats prompt beats captive cable with no prompt.

The Bottom Line

The honest evidence picture in 2026: no documented case of juice jacking at a real public charging station exists in any review we could find, and EFF called the recurring FBI warnings "zombie scaremongering" in April 2023.^[1] That said, the underlying USB attack surface is real, was demonstrated repeatedly in research settings, and got worse in 2025 with ChoiceJacking, which bypassed iOS and Android consent prompts until Apple patched iOS 18.4 and Google patched Android 15.^[3] Practical defenses, cheapest to most expensive: a power bank in your bag, your own wall charger in your pocket, a USB data blocker if you charge from unknown ports often, and the on-screen prompt on a patched phone if you have nothing else.