EV Charging App Phishing Scam

EV charging app phishing scams exploit the fact that most public electric vehicle charge points require payment through a QR code scan-to-pay flow or a dedicated network app, and that there are many competing charging networks each with their own branding and process. Criminals place fraudulent QR code stickers over the genuine ones on charge point units, or publish cloned apps that imitate a legitimate charging network's name, logo, and interface.

Because EV drivers regularly encounter charge points from networks they have never used before, a fake QR code or app does not stand out the way it might in a more familiar context. The driver simply wants to start a charging session and assumes the code or app in front of them is genuine.

The result is either a phishing page that captures full card details under the guise of starting or paying for a charging session, or a cloned app — sometimes sideloaded outside official app stores — that harvests login credentials, payment details, or both.

At the charge point itself, a scammer covers the genuine QR code with their own sticker, styled to match the charging network's branding. A driver scans it expecting to be taken to the network's official payment page to start a session. Instead, the page is a convincing clone that asks for full card details, sometimes alongside creating an 'account' using an email and password the driver may reuse elsewhere.

In the app-based version, a cloned app appears in a third-party app store, or is promoted via a sideload link, using the same name and icon as the real charging network app. Once installed, it may request excessive permissions, harvest login and payment details entered by the user, or simply fail silently while the underlying phishing form has already captured the data.

A related version involves a sticker on the charge point advertising a 'customer support' phone number for when a session fails to start. Calling the number connects the driver to a scammer posing as network support, who talks them through 'resolving' the fault by reading out their card number and security code over the phone.

Electric vehicle drivers frequently encounter charge points belonging to networks they have never used before, so there is no established mental model of what the 'normal' payment flow should look like for any given operator. This lack of familiarity, combined with the pressure to get a vehicle charging quickly — sometimes with limited remaining range — reduces the scrutiny drivers apply to the QR code or app in front of them.

The sheer number of competing charging networks, each with its own app, account system, and branding, also means drivers are used to downloading new apps and entering payment details for services they have not used before, which is exactly the behaviour a cloned app or phishing page is designed to exploit.

Session could not start. Confirm your payment details to activate this charger: [link]

Your charging session failed. Please call our support line to resolve: [phone number]

Claim [amount] of free charging credit — verify your account here: [link]

Payment declined for your last charging session. Re-enter your card to avoid account suspension: [link]

Only use a charging network's app if it was downloaded directly from an official app store search for the network's verified publisher name, or via a link from the network's own official website — never from a QR code at the charge point itself. Check that the charger's unit or bay number displayed in the app matches the physical unit you are standing at.

Before entering card details on any page reached by scanning a QR code at a charge point, check the web address carefully against the charging network's known official domain. If a support number is only available via a sticker at the charge point rather than the network's official website or app, treat it as unverified and look up the real support number independently instead.