USB-C Charging Security: What Businesses Need to Know

Your team probably charges a phone or laptop somewhere other than the office every week: an airport gate, a hotel nightstand, a client’s conference room, a rideshare. USB-C has made that easier than ever, because one connector now charges nearly everything. It has also revived an old question business owners ask us regularly: can a public charging station or an unfamiliar cable actually compromise a company device? The honest answer is that the risk is real but narrow, it is usually overstated in headlines, and a few simple habits reduce it to almost nothing. Here is what the research shows about USB-C charging security and what your business should do about it.

Can a USB-C Charger Really Hack Your Phone?

A USB-C port carries two different things: power and data. A plain wall charger plugged into an AC outlet is designed to deliver power. Modern USB-C chargers do exchange a small amount of signaling with your device to agree on how much power to send, but that negotiation is not the same as a data connection that can browse your photos or install apps.

The concern arises when something on the other end of the cable is not just a power supply. A USB port in a kiosk, a computer, or a tampered cable could contain electronics that try to act as a computer or as a keyboard. That is the scenario security researchers worry about. Simply plugging into a charger does not automatically hand anyone your files; an attacker needs specially built hardware, a target who connects to it, and a way around the protections built into today’s phones and laptops.

What Is Juice Jacking?

A juice jacking attack is one in which a malicious charging port is used to steal data from, or load malware onto, a connected device. The idea was first demonstrated at the DEF CON security conference in 2011, and it resurfaces in the news every few years. In 2023, the FBI’s Denver field office and the FCC both advised travelers to avoid free public USB charging stations.

It is important to separate what has been demonstrated from what has been documented. Researchers have repeatedly shown that these attacks can work in controlled settings. However, journalists and security experts who investigated the warnings, including a widely cited Ars Technica analysis, found no publicly confirmed cases of criminals compromising phones through public charging kiosks. That does not make the risk zero, particularly for targeted individuals, but it does mean public USB charging security belongs well below phishing, weak passwords, and missing updates on most businesses’ priority lists.

The 2025 Research That Renewed the Conversation

In 2025, researchers at Graz University of Technology presented ChoiceJacking at the USENIX Security Symposium. Their custom malicious charger impersonated an input device to approve the phone’s data-connection prompt by itself, and it reached files on every tested device from eight manufacturers. Most variants needed an unlocked phone, although the researchers extracted files from locked devices from two vendors. After the findings were disclosed, Apple added protections in iOS and iPadOS 18.4, and Google added an authentication step in Android 15. Coverage was not complete right away: not every variant was addressed in Android 15, and some manufacturers, including Samsung at the time, had not adopted the new prompt. The lesson for businesses: keeping devices updated matters more than avoiding every charging port.

How Malicious USB-C Cables Work

A malicious USB-C cable is a different and, in some ways, more practical risk. The best-known research example is the O.MG Cable, a penetration-testing tool that looks identical to an ordinary charging cable but hides a tiny wireless implant inside the connector. While dormant it charges and transfers data normally. When activated, it can pretend to be a keyboard and “type” commands into a connected computer at superhuman speed, and some versions can record keystrokes.

This matters most for laptops and desktops, because computers generally trust a newly connected keyboard. Most employees will never encounter such a cable, but a cable found in a conference room or handed out as a giveaway deserves more caution than the one that came in the box.

Are iPhones and Android Phones Protected?

Largely, yes, provided they are updated and employees pay attention to on-screen prompts.

• iPhone and iPad: When a device connects to a computer for the first time, iOS asks whether to “Trust This Computer.” Choosing Don’t Trust blocks access to the device’s content. Since iOS 11.4.1, USB Restricted Mode also limits accessories once the device has been locked for a while.
• Android: On current versions, a USB connection defaults to charging only, and the user must actively choose file transfer. Android 15 adds an authentication step before enabling data access, although not every manufacturer adopted it immediately.
• Mac: Mac laptops with Apple silicon ask permission before a new USB accessory can connect, while still allowing it to charge if you decline.
• Windows: Windows typically accepts new keyboards and many devices automatically. Businesses can use device installation policies and endpoint security tools to restrict what can be connected.

The limitation is human. Every one of these protections can be undone by an employee who taps “Trust” or “Allow” without reading, or by a device that is several updates behind.

Why USB Charging Security Matters for Businesses

A company phone is rarely just a phone. It typically holds business email, Microsoft 365 or Google Workspace sessions, authenticator apps, client contacts, and documents. A business laptop may have saved credentials and access to shared drives. If either device were compromised, the exposure would extend to corporate accounts, not just personal photos.

Unmanaged personal devices add another layer of uncertainty. When employees check work email on their own phones, the business has little visibility into whether those devices are updated. That is why business mobile device security is better addressed through policy and training than through fear of airport outlets. Strong identity controls such as multi-factor authentication also limit the damage if credentials are ever exposed, whatever the cause.

How Managed Devices Reduce the Risk

With a mobile device management (MDM) platform such as Microsoft Intune, a business can enroll company phones, tablets, and laptops and apply a consistent security baseline. Compliance policies can require a minimum OS version, a passcode, and encryption, and Conditional Access can block noncompliant devices from company email and files until they are fixed. On company-owned devices, Intune can also restrict USB file transfer on Android and block supervised iPhones and iPads from pairing with unauthorized computers; these controls are more limited on personal phones. Microsoft Defender for Endpoint adds threat detection and response and can report a device’s risk level to Intune.

None of these tools automatically prevents juice jacking or a malicious USB cable attack. They reduce exposure by keeping devices updated, locked, and monitored, so IT can spot problems and respond quickly.

Seven Ways to Charge Your Devices More Safely

1. Use a trusted wall power adapter. Plugging your own adapter into an AC outlet avoids an unknown USB port entirely.
2. Carry a personal power bank. Charging from a power bank you own and trust avoids unknown public ports. Not every power bank is strictly power-only, since some have data-capable ports or smart features, so buy from a reputable brand.
3. Avoid unfamiliar USB cables. Use cables from the device manufacturer or a reputable brand, and don’t use cables left behind at charging stations or handed out at events. The NSA’s mobile device guidance makes the same recommendation.
4. Prefer AC outlets over unknown USB ports. When both are available, the outlet is the lower-risk choice.
5. Consider a compatible USB data blocker when appropriate. A data blocker passes power but not data. Buy from a reputable vendor, choose one rated for USB-C, and expect that some models may limit fast charging.
6. Keep devices updated. The ChoiceJacking protections arrived through ordinary operating-system updates, which is typical.
7. Follow your company’s device security policy. If your business has rules about personal devices, approved accessories, or reporting incidents, follow them, and ask IT if something seems unclear.

One more habit worth building: if a phone shows a “Trust This Computer” or file-transfer prompt while connected to a charger, tap Don’t Trust or Charge Only and unplug. A real charger has no reason to ask.

What Should You Do If You Connected to a Suspicious USB Charger?

Connecting to an unusual charger does not mean a device is compromised. Respond proportionately:

For Employees

• Unplug and note where and when it happened.
• If you declined every prompt, the risk is very low. If you tapped Trust, Allow, or File Transfer, tell your IT contact.
• Install any pending operating-system updates.
• Watch for unfamiliar apps, unexpected sign-in alerts, or settings you didn’t change, and report them.

For IT Administrators

• Confirm the device is on current software and run an endpoint security scan where supported.
• On an iPhone, resetting Location & Privacy settings clears the list of trusted computers. On Android, confirm developer options and USB debugging are off.
• If the device is enrolled in Microsoft Intune, check its compliance status and any Microsoft Defender alerts.
• Review recent sign-ins for the user’s business email and cloud accounts.
• Reset credentials only if there are signs of suspicious activity, and confirm MFA is enforced.

How MRTECH Helps Businesses Protect Their Devices

USB charging threats are a small piece of a bigger picture: keeping every endpoint updated, monitored, and used safely. MRTECH Computer Support helps growing businesses with:

• Microsoft Intune administration, including device enrollment and mobile device management for company phones, tablets, and laptops.
• Endpoint security, including Microsoft Defender for Endpoint deployment and monitoring.
• Patch and update management so devices receive security fixes promptly.
• 24/7 monitoring and staff training as part of our Managed IT Services.
• Microsoft 365 and Google Workspace security, including MFA and sign-in review.
• Layered cybersecurity services tailored to your team’s size and risk tolerance.

If you’re not sure how well your team’s phones and laptops are protected, book a free 30-Minute Business Technology Risk Review. An MRTECH expert will review your setup with you by phone, Microsoft Teams, or remote session, depending on availability, with no obligation.

Frequently Asked Questions

Can a USB-C charger steal my information?

A standard charger plugged into an outlet cannot. A specially built malicious charger could attempt to, but modern phones require approval or authentication before sharing data. Apple and Google added protections against the bypasses researchers demonstrated in 2025, which is why installing updates matters.

Is charging at an airport safe?

For most travelers with updated devices, the risk is low, and there are no publicly confirmed cases of airport kiosks compromising phones. Using your own adapter in an AC outlet or a power bank removes the question entirely.

Can a malicious USB cable infect a laptop?

It is possible. Cables with hidden electronics can pose as a keyboard and type commands into an unlocked computer. This is a targeted technique rather than an everyday threat, which is why it’s sensible to use only cables you trust and lock your screen when stepping away.

Do USB data blockers work?

A quality USB data blocker prevents data from passing while allowing power, so it addresses the juice jacking scenario. Choose a reputable USB-C model and be aware it may reduce charging speed.

Is a power bank safer than a public USB port?

Usually, yes. A trusted power bank you own avoids an unfamiliar public port, which reduces your exposure. Not every power bank is strictly power-only, since some include data-capable ports or smart features, so choose a reputable brand and use it with a cable you trust.