Juice Jacking: Public Charging Ports and Rigged Cables through a QR code

How it looks through a QR code, the red flags and what to do.

QR scams work because people trust the little square. The code may open a payment screen, a fake website or an app download. Juice Jacking: Public Charging Ports and Rigged Cables is one of the ways this shows up: Can a public USB port or a gifted cable steal data from your phone? See what is real, what is rare and how to charge safely at stations and airports.

What juice jacking: public charging ports and rigged cables looks like through a QR code

• A QR that opens a payment screen with an amount already filled in.
• A code that downloads an app.
• A sticker pasted over a shop or parking QR code.

A USB cable carries both power and data. A rigged port or cable can be built to ask your phone to start a data connection as well as charge it. If your phone is unlocked and you tap 'allow' on a prompt about file transfer or trust, software on the other end can try to read files or push an app. Modern phones show a prompt first, which is why the dangerous moment is the tap.

Red flags to check on the QR code

• A charging point asks your phone to allow file transfer or trust the device.
• A person urges you to tap 'allow' to charge faster.
• A cable is handed to you as a free gift by someone you do not know.
• A free-charging offer comes with a QR code or app download.
• The link opens an app download instead of a payment page.
• The amount is filled in and you did not expect to pay.

What to do

1. Carry your own charger and plug it into a normal wall socket when possible.
2. Use a power bank for travel, so you do not need public ports.
3. If you must use a USB port, choose 'charge only' and deny any data or trust prompt.
4. If you paid the wrong place, call 1930 at once and tell your bank.
5. Do not scan codes sent by strangers. Receiving money never needs a scan or a PIN.
6. Before paying, read the payee name and the amount on the payment screen.

If you lost money through a QR code, call 1930 and report at cybercrime.gov.in; tell the bank the transaction details.

If money or a code is already gone

1. If you paid or shared card details for a charging offer, call 1930 and report at cybercrime.gov.in.
2. Call your bank through the number on your card and ask to block the card if you typed it.
3. Remove any app that was installed and change passwords from a different device.
4. Review your phone for unknown apps and permissions, and restart it.

National Cyber Crime Helpline: 1930; report at cybercrime.gov.in.

Phone scan in Safeavio Sentinel reviews installed apps, permissions and risky settings such as unknown sources and developer mode, which helps you notice if something strange was installed. QR check shows where a charging-offer code leads before you open it. Safeavio cannot detect a rigged cable and cannot see what a charging port does, so the best defence is your own charger or a power bank.

Full guide: Juice Jacking: Public Charging Ports and Rigged Cables: how it works, signs and what to do. Other channels: fake app, social media, SMS.

Questions