A scammer puts malware or monitoring software into a public USB port. That gives them the ability to steal data off a phone when it plugs in, including passwords, addresses, and banking information.