Public EV chargers are networked computers connected to the power grid, your vehicle, and the internet simultaneously. That combination creates a cybersecurity surface that didn't exist in the era of gasoline pumps. Researchers have demonstrated real vulnerabilities — not theoretical ones — in publicly deployed charging hardware, and the industry's response has been uneven. This doesn't mean you should stop using public chargers, but it does mean understanding the risks, what's actually been demonstrated in the real world, and what practical precautions make sense.

What Cybersecurity Researchers Have Actually Demonstrated

Before listing threats, it's worth being precise about what has been demonstrated in controlled research versus what remains theoretical:

The honest picture: credit card skimming and QR code phishing at charging stations are real, documented problems. The more alarming scenarios — vehicle takeover via a compromised charger — remain in the research domain and have not been confirmed in real-world attacks. The threat landscape for everyday EV drivers is primarily about payment security and account credentials, not vehicle safety.

Payment Security at Public Chargers

Card Skimming: The Most Common Threat

Physical card skimmers — counterfeit overlays placed on payment terminals — have been found on public EV chargers in several US states. California, Florida, and Texas have documented incidents. The attack is identical to skimmers found on ATMs and gas station pumps: a physical device captures magnetic stripe data or records PIN entry. Modern chip-and-PIN transactions are harder to skim but not impossible if the terminal is compromised at the hardware level.

• →Physically inspect the card reader before inserting your card — look for misaligned edges, loose components, or unusual overlays
• →Wiggle the card slot — legitimate readers are firmly mounted; skimmer overlays often have some play
• →If the reader looks unusual, use the network's mobile app to initiate the session instead
• →Tap-to-pay (NFC/contactless) is significantly harder to skim than card insertion — prefer this when available

QR Code Phishing ('Quishing')

A newer and growing threat: fraudulent QR code stickers placed over or next to legitimate charger QR codes. Scanning a fake code takes you to a phishing site that mimics the real charging network, captures your payment information, and potentially installs malware if you're tricked into downloading a fake app.

• →Before scanning a QR code at a charger, check whether the sticker looks different from others on the same station (different font, quality, placement)
• →After scanning, verify the URL in your browser matches the official network domain before entering any payment information
• →Use the official app (downloaded from the App Store or Google Play) to initiate sessions rather than scanning QR codes whenever possible
• →If you're taken to an unfamiliar URL after scanning, close the browser and use the network app directly

EV Tech Pick · EV Shop

EV Tech Pick · EV Shop

⭐ Top Pick

VANMASS Military-Grade Car Phone Mount

Military-Grade Metal Clamp — Strongest Windshield Phone Mount

~$20–$35Shop on Amazon

* Amazon affiliate link — EV Charger Scout may earn a small commission at no extra cost to you.

Account Security for Charging Network Apps

Your charging network accounts (ChargePoint, Electrify America, EVgo, Tesla, etc.) link to payment methods and personal information. A compromised account can be used to charge sessions to your payment method or access personal data. Standard account security hygiene applies, but the specifics matter:

Vehicle-Level Risks: What the Research Shows

Researchers at Idaho National Laboratory (INL), Sandia National Laboratories, and several academic institutions have investigated whether a compromised charger could communicate maliciously with a connected vehicle. The honest assessment: this attack surface exists but is currently difficult to exploit in practice for several reasons.

The OCPP Layer

Most public chargers communicate with their network management systems via OCPP (Open Charge Point Protocol). OCPP handles session management, billing, and remote diagnostics. Research has shown that some OCPP implementations use unencrypted communication (OCPP 1.6 over plain WebSocket), which allows an attacker with access to the local network to intercept charger-network communication.

Critically: OCPP handles charger management, not direct vehicle communication. An attacker exploiting OCPP can potentially disrupt charging sessions or manipulate billing records — not inject commands into the vehicle's systems. The car and the charger communicate via a separate protocol (ISO 15118 / PLC), which has its own security architecture.

ISO 15118 and Vehicle Communication Security

ISO 15118 is the protocol governing the communication between a vehicle and a charger during a DC fast charging session — including Plug & Charge authentication and smart charging negotiation. ISO 15118 uses TLS (transport layer security) and certificate-based authentication, which provides meaningful protection against man-in-the-middle attacks on the vehicle-charger communication layer.

Research into ISO 15118 vulnerabilities has identified issues in some implementations, particularly around certificate validation and power line communication (PLC) channel security. No confirmed exploitation of these vulnerabilities in a real-world attack has been publicly reported, but the research community continues to publish findings and push for stronger implementation standards.

Infrastructure-Level Risks: Grid Security

Beyond individual drivers, cybersecurity researchers and government agencies (DHS, CISA) have focused on charging infrastructure as a potential grid vulnerability. A large-scale coordinated attack on public chargers — causing simultaneous demand spikes or disruption — could theoretically destabilize grid segments.

This is a concern for infrastructure operators and policymakers, not individual EV drivers. CISA issued guidance in 2024 on cybersecurity requirements for publicly funded EVSE (particularly NEVI-funded stations), including mandatory security audit requirements and incident reporting protocols. The federal government treats charging infrastructure cybersecurity as critical infrastructure security — the same category as the power grid itself.

DC Fast Charging Upgrade · EV Shop

DC Fast Charging Upgrade · EV Shop

UL 2252Best Value

LENZ CCS1-to-Tesla NACS Adapter

UL 2252 Certified — Charge Your Tesla at CCS1 DC Fast Stations

~$80–$190Shop on Amazon

* Amazon affiliate link — EV Charger Scout may earn a small commission at no extra cost to you.

What to Actually Do: Practical Safety Measures

Prioritized by realistic risk level for an individual EV driver:

1. 1Use mobile app or NFC payment instead of card insertion at unfamiliar or low-traffic chargers — eliminates the most common real-world attack vector
2. 2Verify QR code legitimacy before scanning — physically inspect stickers and check the URL before entering any information
3. 3Enable 2FA on all charging network accounts — takes 2 minutes and closes the account takeover risk significantly
4. 4Download charging apps only from official app store listings, not links in QR codes or emails
5. 5Monitor your charging account history monthly for unrecognized sessions — set up email receipts if the network offers them
6. 6Report suspicious charger modifications (loose readers, unusual stickers) to the network operator and to your local law enforcement
7. 7Keep your vehicle's software updated — manufacturers patch security vulnerabilities in OTA updates, including those related to charging communication protocols

How Networks and Manufacturers Are Responding

The industry is taking cybersecurity more seriously in 2025–2026 than at any prior point. Key developments:

• →NEVI program requirements mandate OCPP 2.0 (encrypted, more secure) for all newly federally funded EVSE — this is a binding requirement, not a recommendation
• →ChargePoint, EVgo, and Electrify America all run bug bounty programs that pay security researchers to find and responsibly disclose vulnerabilities
• →Tesla's charging network uses a proprietary communication stack with TLS throughout — its security track record is stronger than most open-standard implementations
• →The SAE International cybersecurity standard (SAE J3061) and ISO/SAE 21434 now apply to EV charging systems — manufacturers must demonstrate cybersecurity architecture in certification
• →Several states (California, New York) have adopted or are adopting state-specific cybersecurity requirements for commercial EVSE that exceed federal minimums

International Cybersecurity Standards for EV Charging

The Bottom Line: How Worried Should You Be?

Not very — but not zero. The realistic threat for an individual EV driver is financial fraud through payment terminal skimming or QR code phishing, both of which are mitigated simply by using app-based payment and verifying QR codes before scanning. Vehicle-level attacks via chargers remain in the research domain without confirmed real-world incidents.

The more concerning threat picture is at the infrastructure level — the potential for coordinated attacks on charging networks affecting grid stability — and this is the focus of government agencies, not something individual drivers can meaningfully address. What you can do is support networks and manufacturers that take security seriously, and report anything suspicious you observe at charging stations.

Public charging is not a security minefield. It's a mature utility infrastructure with real but manageable security considerations — not unlike using any networked financial service in public.