What Is Juice Jacking? The Airport USB Charging Risk, Explained

Juice jacking is the name for a decade-old attack idea in which a public USB charging port or cable — the kind built into airport seating, hotel nightstands, or rental-car consoles — is rigged to do more than deliver power. Because a standard USB connection can carry both electricity and data on the same wires, a compromised port or cable can, in theory, try to install malware on a connected phone or quietly copy files off it while it charges. The short version for anyone packing for holiday travel: the risk is real in a laboratory sense, it has never been tied to a documented case of a traveler actually losing data this way, and the handful of habits that protect you — your own charger, a wall outlet, and paying attention to the "Trust This Computer?" prompt — take about as much effort as untangling a charging cable in the first place.

What is juice jacking, exactly?

The term describes any attack that abuses a USB charging connection to reach a phone's data instead of, or in addition to, its battery. A standard USB-A or USB-C cable has separate pins for power and for data, and most phones keep that data channel live by default the moment a cable is plugged in. If someone has tampered with a public charging station or cable — wiring a small computer into a kiosk, or hiding a data-capable chip inside a cable that looks ordinary — that data channel is theoretically available to them too, without a traveler ever typing a password or clicking a link.

What makes it different from phishing or smishing is that it doesn't rely on tricking you into an action beyond the one you were already going to take: plugging in to charge. That's also why it gets attention every travel season — it targets a habit almost everyone already has.

Where the risk actually lives

The scenario security researchers and federal agencies describe centers on free, shared USB-A charging points: the furniture-style kiosks at airport gates, phone-charging lockers in shopping malls, USB ports built into hotel lamps and headboards, and the charging bars often set up at conferences. The common thread is a port or cable that many strangers use and that nobody travelling can verify hasn't been altered. A standard electrical (AC) wall outlet, by contrast, only delivers power — there's no data pin to exploit, which is why it's the baseline recommendation from every agency that has weighed in.

How serious is the risk, really, in 2026?

This is the part that tends to get lost in the warnings: juice jacking has been demonstrated by researchers repeatedly since a proof-of-concept kiosk appeared at the DEF CON hacker conference in 2011, and government agencies have periodically flagged it as a theoretical risk, but no agency or independent security researcher has documented a confirmed case of an everyday traveler's phone being compromised this way in the wild. The FBI's own Denver field office, which issued a widely-shared warning in 2023, described it as a general public-service reminder rather than a response to a specific incident.

That doesn't make the warnings pointless. Phone makers have spent over a decade closing the exact gaps juice jacking relies on — modern iPhones and Android phones no longer silently mount as a drive when plugged in, and both platforms now ask for explicit permission before a connected computer can read anything. The attack is harder to pull off today than it was in 2011, and security researchers have also kept finding new ways around those permission prompts (a newer line of research, nicknamed "ChoiceJacking," showed some ports could simulate the taps needed to approve a data connection), which is part of why agencies keep repeating the advice rather than retiring it. Treat it the way you'd treat a seatbelt: a low-probability event with a cheap, easy precaution.

What the FBI, FCC, and TSA have actually said

Several U.S. agencies have weighed in on public charging over the past few years, and it's worth being precise about what they did and didn't say:

• The FCC maintains a consumer guide, "What is 'Juice Jacking' and Tips to Avoid It," explaining that malware delivered through a compromised USB port can lock a device or export personal data and passwords, and warning that in some cases bad actors have intentionally left infected cables plugged in at charging stations, or handed them out as promotional giveaways. Its recommendations: use an AC power outlet instead of a USB port, carry your own AC adapter, car charger, and cables, pack a portable battery, and if a prompt asks you to choose between sharing data and charging only, choose charge only.
• The FBI's Denver field office posted a public warning in 2023 advising travelers to avoid free charging stations in airports, hotels, and shopping centers, and to carry their own charger and cord to use with a standard electrical outlet instead. The bureau described it as a general reminder, not a response to a known local incident.
• TSA has periodically repeated similar advice to travelers around peak travel periods, pointing people toward their own power brick, battery pack, or a standard wall outlet rather than an unfamiliar USB port, alongside separate advice about avoiding sensitive logins over unsecured public Wi-Fi.

None of these agencies has published incident counts or confirmed victim cases — the warnings are precautionary, aimed at a low-cost habit change rather than a documented ongoing scam.

The "Trust This Computer?" prompt is your safety net

Modern phones are built to ask before they hand over data, and understanding that prompt is the single most useful piece of security literacy for this topic. On an iPhone or iPad, Apple's documentation on the "Trust This Computer" alert explains that a newly connected computer or accessory can't sync with your device or access its photos, contacts, and other content until you unlock the device and tap Trust. Apple is explicit about the flip side, too: "If you choose not to trust a computer, you block its access to content on your device" — tapping Don't Trust is a complete, no-downside way to shut down a suspicious connection. Apple's separate Wired Accessories setting (Settings → Privacy & Security → Wired Accessories) governs the same behavior for any USB or Thunderbolt accessory, not just computers: by default, the iPhone "won't communicate with the accessory" while locked, though a plain USB power adapter still charges it normally.

Android handles it similarly: the first time a phone connects to a given computer, it shows a prompt before opening a file-transfer connection, and Google's support documentation on transferring files over USB walks through choosing that connection type manually from the notification shade rather than having it happen automatically. Newer Pixel phones go a step further: Google's USB Protection feature, part of Advanced Protection Mode, blocks any new USB data connection outright while the screen is locked — "charging through USB continues to function even with a locked screen," Google notes, but data access stays off until you unlock the phone and reconnect.

In both cases, the mechanism that would stop a malicious charging station is already built into the phone and switched on by default. The practical takeaway: if you ever plug in somewhere unfamiliar and see a prompt asking you to trust the connection or share data, that's the moment to say no — it costs you nothing but a few seconds, and it's the phone itself telling you something is trying to reach beyond the battery.

Safe vs. risky charging habits

How to protect yourself

• Pack your own charger and plug it into a wall outlet. This is the advice every agency agrees on, and it sidesteps the entire category of risk.
• Carry a portable battery pack. Useful when outlets are scarce at a gate, and it means you're never relying on a kiosk's internals.
• Use a USB data blocker if you do need a public port. These small adapters (sometimes called "USB condoms") sit between your cable and the port and physically block the data pins, leaving only power to pass through.
• Watch for the prompt. If your phone asks whether to trust a connected device or share data, tap Don't Trust on iPhone or decline/ignore the data-transfer notification on Android. Charging continues either way.
• Be suspicious of cables you didn't bring. A cable already plugged into a public station, or one handed to you as a free gift, is exactly the scenario the FCC has called out by name.
• Turn on your phone's strictest lock-screen USB protection. On supported Pixel phones, Advanced Protection Mode's USB Protection blocks new data connections entirely while locked; on iPhone, check that Wired Accessories is left on the default "Automatically Allow When Unlocked" setting rather than "Always Allow."
• Keep your phone's software up to date. Most of the operating-system defenses described above arrived through routine updates — an out-of-date phone is the one still running the oldest, most permissive USB behavior.

It's not just the charging port

Juice jacking tends to dominate the headlines because it's a vivid, visual idea, but the same airports and hotels pose a more common, better-documented risk: unsecured public Wi-Fi. A network you don't control can expose traffic to a man-in-the-middle attack, where someone intercepts data passing between your device and the sites you're using. Running a reputable VPN on airport or hotel Wi-Fi, and avoiding banking or other sensitive logins on networks you don't recognize, closes a gap that's arguably more exploitable today than a charging cable.

What's next: charging smart through the holiday travel season

Airport USB charging searches spike every year in the run-up to Thanksgiving and the winter holidays, as millions of travelers hunt for an outlet before a flight — which is exactly why these warnings resurface on a predictable schedule rather than in response to new incidents. Heading into this year's travel crunch, the practical move is simple: pack a compact wall charger and a short cable, throw a battery pack in your carry-on if you'll be stuck at a gate, and treat any "trust this device" or "share data" prompt as your cue to decline. None of that requires giving up on topping off your phone before boarding — it just moves where the power comes from. Expect the same seasonal reminders from TSA and consumer-protection outlets again this winter, and expect them to keep saying what they've said since 2023: it's a precaution worth taking, not a crisis that's already happened to you.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage