For years, travellers have been told that plugging a phone into a public USB port at an airport, station or café could hand their data to a stranger. The warning is now so familiar that it functions as folklore. But the regulator that has repeated it most consistently also concedes something rarely quoted: it has no record of a single confirmed case. That gap between reputation and evidence is the real story behind juice jacking — and it is more interesting than either the panic or the dismissal.
- A warning without a body count: the FCC has cautioned against public USB ports since at least 2021, yet its own guidance states it is unaware of any confirmed real-world attack.
- Proof of concept, not epidemic: researchers at the Graz University of Technology showed in 2025 that a manipulated charger can bypass the consent prompts Android and iOS introduced roughly a decade ago.
- Patches exist: Google, Samsung and Apple have shipped fixes tied to the findings, making software updates the single most effective defence.
What Authorities Say, and What They Omit
The FCC’s advisory page describes the scenario plainly: criminals could load malicious software onto public charging stations to access connected devices, lock them, or extract personal data and passwords. It is a technically coherent description of a possible vector — and it is presented as exactly that, a demonstration rather than an observed campaign.
The most widely shared alarm came from the FBI’s Denver field office in April 2023, in a message that travelled far beyond its original audience:
“Avoid using free charging stations in airports, hotels or shopping centers.”
That advisory cited no recent consumer harm, and the bureau did not immediately explain what had prompted it. The result was a textbook mismatch between a precautionary nudge and the epidemic framing that followed in headlines. The documented risk lives in laboratories, not in departure lounges.
Inside ChoiceJacking: Beating a Decade-Old Defence
The research that revived the debate is titled “ChoiceJacking: Compromising Mobile Devices through Malicious Chargers like a Decade ago”, presented at USENIX Security 2025, held in Seattle from 13 to 15 August 2025. Its authors — Florian Draschbacher, Lukas Maar, Mathias Oberhuber and Stefan Mangard — are affiliated with Graz University of Technology, with Draschbacher also linked to A-SIT Austria.
Their insight is almost embarrassingly simple. After the first generation of charger-based attacks, mobile operating systems began demanding user confirmation before opening a USB data connection. That defence assumed a charger could not generate input. The team showed it can: a malicious charger impersonates a keyboard or accessory and effectively presses the “allow” button itself.
The paper reports access to sensitive files — photos, documents, application data — on 11 devices from 8 manufacturers, including the six largest by market share. On two vendors’ hardware they extracted files while the phone was locked. To avoid detection on unlocked handsets, they exploited a side channel on the power line to time their activity for moments when nothing suspicious would appear on screen. Every test ran in a lab, on devices dedicated to the research.
The distinction matters: the work proves the attack is feasible, not that it is in use. It offers no real-world cases, and the FCC knows of none either.
Patches, CVE Numbers and Sensible Habits
Disclosures went to manufacturers between June and July 2024, and fixes followed. Google assigned CVE-2024-43085, rated high severity, and patched it in the November 2024 Android security bulletin; Samsung assigned CVE-2024-20900. Xiaomi, Huawei, Vivo and Honor confirmed the findings and were preparing updates at publication time. Apple had added authentication prompts for USB connections in iOS 17.5 but had not yet carried them into iOS 18, according to the paper. Later iOS 18.4 and iPadOS 18.4 security notes list a fix credited to Draschbacher — CVE-2025-24193 — where an attacker with a USB-C connection to an unlocked device could programmatically reach photos; Apple resolved it with “improved authentication checks”, across several iPad models.
The practical lesson is unglamorous: an unpatched handset keeps holes that newer builds have already closed. For travellers, the hierarchy of precautions is clear. Use a wall socket with your own charger, or carry a power bank. A charge-only cable or a USB data blocker from a reputable vendor works, though the Graz team notes two caveats — it only helps people already aware of the threat, and it can interfere with modern power negotiation, so devices charge more slowly. If a prompt appears, choose charge-only; if a public port asks you to unlock or confirm something the moment you connect, unplug.
Juice jacking has been oversold as an everyday menace and undersold as a design problem. ChoiceJacking showed that the safeguard everyone trusted had a structural flaw — and that researchers, not criminals, were the ones who closed it. For the average passenger, the residual risk remains small, but the cost of a private charger and a current software build is smaller still.