Juice Jacking Alert: CERT-In Warns Indians Against Public USB Charging Stations

Guwahati: Indian cybersecurity agencies and financial regulators have warned commuters against using public USB charging stations at railway stations, airports, hotels and shopping malls across the country.

The ongoing 2024–2026 advisory highlights the risk of juice jacking, an attack that can steal sensitive information or install malware when users connect their smartphones to compromised charging ports.

Juice jacking is a cybersecurity threat involving compromised public USB charging ports. These ports can potentially exploit the connection between a smartphone and a charging point to access sensitive information or introduce malicious software.

According to the Indian Computer Emergency Response Team (CERT-In), cybercriminals may tamper with publicly accessible charging facilities to target unsuspecting users.

The warning covers public charging points commonly found in cafes, hotels and airports. Railway stations and shopping malls are also among the public locations where commuters may encounter shared charging facilities.

CERT-In operates under the Ministry of Electronics and Information Technology and serves as India's national cybersecurity agency.

Standard USB connections support both electrical power and data transfer. A USB connector has five standard pins, including one carrying power and two handling default data transfer. This combination creates a potential security risk when users connect their smartphones to compromised public charging ports.

CERT-In warned through an official public advisory on X, "Cybercriminals may use public USB charging ports installed in places such as cafes, hotels, and airports to trap users in juice-jacking attacks, allowing hackers to steal sensitive user data or install malware on connected devices."

The warning identifies two primary attack methods: stealing sensitive information and installing malicious software.

Stolen information could include passwords, one-time passwords (OTPs) and banking credentials. Malware infections may also compromise the connected device.

Public charging kiosks are widely used by passengers travelling through railway stations and airports. Commuters often depend on these facilities when their smartphone batteries run low.

However, the convenience of shared USB charging points can carry security risks if the ports or connected hardware have been compromised. The warnings also extend to hotels and shopping malls, where public charging facilities may be available.

The Reserve Bank of India (RBI), India's central banking institution, has also issued consumer financial safety warnings concerning such risks.

Cybersecurity recommendations highlight three practical alternatives to potentially compromised public USB charging ports.

• Use a personal AC adapter: Carry your own wall charger and connect it to a standard electrical socket.

• Carry a power bank: Use a portable power bank instead of relying on shared USB charging kiosks.

• Use a USB data blocker: This hardware accessory helps prevent data transfer while allowing power to pass through.

Users connecting devices to public charging facilities should also select the "Charge Only" option when prompted, where available.

The continuing warnings from cybersecurity and financial authorities highlight the need for caution when charging smartphones in public places.

Passengers using railway stations, airports, hotels and shopping malls should avoid unfamiliar public USB charging ports and choose safer charging alternatives.

Protecting personal devices and banking information starts with treating public charging connections as potential security risks rather than automatically trusted power sources.

Also Read: Romi Meitei’s Whispers of the Shadow Selected for 31st IFFK