Key takeaways

Treat public Wi-Fi as a shared room and public USB ports as someone else’s equipment. Use your own charger, use mobile data for banking, and never type card or bank details into a Wi-Fi sign-in page.

  • The FTC says most public networks are not encrypted and tells you to check for https on every page.
  • CISA advises avoiding open networks for banking or shopping, and avoiding any charging station or computer you do not control.
  • No verified victim of a malicious charging kiosk had been identified when Slate looked into the 2023 FBI Denver post, so the real everyday risk is more often a fake page than a booby-trapped port.

Got a network name, site, or app that prompted you to pay or sign in? Check the scam directory.

How public Wi-Fi and charging station scams work

These are two different threats that get bundled together. The first is a network or sign-in page set up, or imitated, to collect what you type. The second is the idea that a shared charging point could be used to reach into your phone. The official advice is similar for both: do the sensitive things somewhere you control, and do not rely on a place being safe because it is busy and respectable.

The FTC’s public Wi-Fi advice starts from a plain fact: most public networks are not encrypted, and the only reliable sign is that the network asks for a WPA or WPA2 password. Even then, anyone else who knows that password shares the network with you. On an unencrypted network, the FTC says, the safe habit is to look for https on every page you visit, not just the login page, because secure sites encrypt your information even when the network does not.

CISA’s travel guidance goes further for money tasks. It advises avoiding open networks for banking, shopping, or other personal business, and says that if you must transact, you should turn off Wi-Fi and use your phone’s cellular data. The NCSC, the UK’s national cyber security agency, makes a related point: a private WPA2-protected network is more secure than public Wi-Fi in places like coffee shops or hotels, and it recommends using https for web services and keeping devices patched.

The fake sign-in page problem

Most real-world trouble with free Wi-Fi comes from the sign-in step, not from clever interception. A page appears asking you to “verify” yourself before you can get online. Scambaba’s advice is to treat any such page that asks for more than an email address or a room number as a red flag. A card number, bank login, or the password to your email account has no place on a hotspot page, and a request to install an app to get online is worth refusing.

What is actually known about charging kiosks

In April 2023 the FBI’s Denver field office posted a warning to avoid free charging stations in airports, hotels, and shopping centers, saying bad actors had found ways to use public USB ports to introduce malware and monitoring software. Slate reported that an FBI Denver spokesperson described it as a resurfaced standard PSA-type post pointing back to a 2019 FCC page, that the FCC could not provide details of cases, and that Slate found no verified victims. The same report notes the concept has been treated as a proof of concept since a 2011 DEF CON demonstration, and that the FCC’s 2019 page said infected cables had been given away as promotional gifts.

That is a fair summary of where the evidence stands: possible and demonstrated in a lab, but not shown to be common. CISA’s guidance stays cautious regardless. It says a USB connection can let software on the other computer interact with your phone in unexpected ways, and advises not connecting to any computer or charging station you do not control. Since carrying a charger costs little, the sensible reading is to follow that advice without panic.

Two illustrative examples

These are composite scenarios written for this guide, not reports of specific incidents.

The airport lounge. You land, your phone is at 8 percent, and the departures board shows a 40 minute delay. You join an open network that has the airport’s name in it plus the word “Free”. A page loads and asks for your name, email, and, to “enable fast streaming”, a card number with a promise of no charge. Nothing in the official advice describes a legitimate hotspot needing a card. The safe move: close the page, switch off Wi-Fi, use mobile data for anything involving money, and plug your own charger into a wall outlet. If you already typed the card number, call the card provider from the number on the card and ask for a replacement.

The kiosk prompt. You plug a cable into a charging kiosk and the phone asks whether to trust the device or allow data access. For charging alone, pick charge only, or unplug. If the phone gives no option and you cannot tell what is happening, stop and use an outlet.

Eight warning signs

  1. An open network with no password. The FTC says most public networks are not encrypted, and a network is only reliably encrypted if it asks for a WPA or WPA2 password. If you are unsure, treat it as unsafe.
  2. A network name that nearly matches the venue. Scambaba advice: if a café shows two networks with almost the same name, ask staff for the exact name. Do not pick the stronger signal and hope.
  3. A sign-in page that wants more than it should. Scambaba advice: free Wi-Fi sign-in pages do not need your card number, bank login, or email password. Close the page and use mobile data instead.
  4. Pages without https in the address. The FTC says to look for https on every page you visit, not just the login page, and to enter personal information only on encrypted sites.
  5. A pop-up that says your device needs an update or a “security app”. Software updates come from your device’s own settings, not a hotspot page. See fake antivirus and browser notification scams.
  6. A charging kiosk or cable you do not control. CISA advises avoiding connecting your phone to any computer or charging station you do not control. A wall outlet with your own charger removes the question.
  7. A prompt to “trust this computer” or share data when you only wanted power. A pure charger should not need to ask about data. Choose charge only, or unplug. If you are unsure, stop.
  8. A free cable or charger handed out by a stranger. Slate reports that the FCC’s 2019 page said infected cables had been given away as promotional gifts. Use cables you bought from a source you trust.

How to use public Wi-Fi and charging more safely

  1. Get the exact network name from staff. Do not pick from a list of lookalikes. This is Scambaba advice rather than a quoted rule.
  2. Check https on every page, as the FTC advises, and enter personal information only on encrypted sites.
  3. Keep money tasks for mobile data or home. CISA says to turn off Wi-Fi and use cellular data if you must transact.
  4. Do not email financial details. The FTC says not to email card, Social Security, or bank account numbers, even on a secure network.
  5. Use different passwords for different sites, and log out when finished, so one stolen login does not open others.
  6. Turn off Bluetooth when you are not using it. CISA notes attackers can pair with an open connection.
  7. Charge from a wall outlet with your own charger, or use a power bank. If you must use a USB port, choose charge only when prompted.
  8. Keep your phone and apps updated. The NCSC says prompt patching protects data sent over Wi-Fi even where the network is weak.

If you think you were caught out

Act on what you typed or approved. These steps draw on the FTC’s “what to do if you were scammed” guidance and CISA’s advice on suspected exposure.

  1. Disconnect. Turn off Wi-Fi and Bluetooth, and unplug the cable. Switch to mobile data.
  2. If you typed a password, change it from a different, trusted device, change it anywhere you reused it, and turn on two-factor authentication. The FTC gives this exact sequence.
  3. If you typed card details, call the card issuer on the number on the back of the card, say the charge is unauthorized or that you were tricked, and ask for a refund and a replacement card.
  4. If you typed bank login details, call your bank right away from a known number and ask them to secure the account.
  5. If you installed something, update your security software, run a scan, delete what it flags, and change your passwords. The FTC says to contact the device maker or a trusted technician if you need help removing malware. See fake antivirus and browser notification scams.
  6. If an account is already locked out or behaving oddly, follow SIM swap and account takeover steps.
  7. Report it. Tell the venue or network operator, and use the list below.

Where to report

More help from official sources

Scambaba is an independent educational project. Reporting and recovery options depend on where you live. Items marked as Scambaba advice are practical suggestions, not quotations from an agency. How these guides are researched is on the editorial policy.

Frequently asked questions

Is it safe to use public Wi-Fi at all?

It is lower risk than it used to be because most sites now use https, but it is still not ideal for sensitive tasks. The FTC says not to assume a public network is encrypted and to enter personal information only on encrypted sites. CISA advises avoiding open networks for banking or shopping and using mobile data instead.

What is “juice jacking”, and has it really happened?

Juice jacking is the idea that a public USB port or cable could be used to load malware onto or pull data from a phone while it charges. Slate reported in 2023 that it found no verified victims, that the concept had been discussed since a 2011 DEF CON demonstration, and that an FBI Denver spokesperson called the April 2023 post a resurfaced standard PSA. The risk looks small, but the precaution costs nothing, so carry your own charger.

Does a VPN make public Wi-Fi safe?

A VPN encrypts traffic between your device and the VPN provider, and the NCSC mentions a well-configured VPN for enterprise traffic. It does not protect you from entering your details on a fake page. Use a provider you have researched and are paying for, and note that a free VPN pushed by a pop-up is itself a red flag.

Is mobile data safer than hotel or airport Wi-Fi?

For banking and shopping, CISA advises turning off Wi-Fi and using your phone’s cellular data when you must transact away from home. The NCSC also says a private WPA2 network is more secure than public Wi-Fi in places such as coffee shops or hotels.

I plugged into a charging kiosk. Should I wipe my phone?

Probably not, but be sensible. Restart the phone, install pending updates, check for apps you do not recognise, review recent sign-in alerts on your email and bank, and change your main passwords from a different device if anything looks wrong. If you chose “trust this computer” or allowed data access, treat it more seriously and ask the manufacturer or a trusted technician for help.

What should I do if I entered my card details on a free Wi-Fi page?

Call your card provider using the number on the back of the card, say you entered details on a page you now doubt, and ask them to block and replace the card. Then watch statements for small test charges and report the page to the venue. The FTC says to contact the card issuer, tell them the charge was unauthorized or that you were tricked, and ask for a refund.

Are hotel Wi-Fi “login with your room number” pages a scam?

Many are genuine, and asking for a room number and surname is common. The warning sign is a page that asks for a card number, an email password, or an app install. Ask the front desk for the exact network name and sign-in steps instead of relying on a page you reached by clicking a pop-up.