EV charging scam: how fake QR codes target electric car drivers
Electric vehicle drivers are being warned about scams at public charging stations. Rinnovabili has previously reported on fraud targeting BEV owners, including the cloning of charging cards. But criminals continue to develop new methods, and another form of fraud could potentially occur in Italy, if it has not already. French newspaper Le Figaro recently reported a case in Lyon, where a man encountered an unusual scam in mid-August involving a fake QR code used to access EV charging services.
Fake QR codes placed on EV charging stations
Fraudsters had placed stickers containing counterfeit QR codes over the legitimate codes displayed on public charging stations. When an unsuspecting driver scanned one of these codes with a smartphone, they were redirected to a fraudulent website designed to steal their personal and payment information.
There was one small but significant difference between the legitimate website and the counterfeit page created for the scam: the fraudulent address used the “.site” domain instead of “.com”. Through this method, the perpetrator was able to steal both the money paid by customers and their banking details.
According to the charging company, around ten people were caught by the scam.
Drivers can reduce the risk of falling victim to this type of fraud by checking that the website opened after scanning a QR code corresponds to the official website of the charging operator. Taking a few seconds to verify the website name and domain can help identify a fraudulent page before entering payment details.
EV charging scam risks also include card cloning
Fake QR codes are not the only threat. EV drivers also need to be cautious about charging card cloning, a form of digital fraud that exploits hardware vulnerabilities and weaknesses in the RFID authentication systems used by many public charging stations.
Many charging operators use physical cards to allow customers to start a charging session. To speed up authentication, some charging infrastructure reads the unique identification code, or UID, stored on the card’s chip rather than performing a more complex exchange of encrypted keys.
Using portable devices capable of cloning radio signals at RFID or NFC frequencies, together with dedicated smartphone software, fraudsters can intercept and duplicate the victim’s card UID.
By bringing the cloned device or card close to the charging station, the system may recognise the original identifier, authorise the charging session and charge the cost of the electricity to the legitimate cardholder’s account.
How stolen charging credit can be exploited
Because charging credit can only be used to supply electricity to a vehicle, criminals need a way to monetise what they have stolen. The energy can be resold at around half price through Telegram channels or the dark web, or used to charge vehicles belonging to complicit corporate fleets or unauthorised transport services in exchange for cash.
To make it harder to trace vehicles through their number plates, fraudsters may choose charging stations in areas without CCTV coverage, such as industrial sites or underground car parks. They may also physically alter number plates in an attempt to evade automatic number plate recognition cameras.