Modern chargers are connected devices. They talk to management software, take payments, receive remote commands and download firmware. That connectivity is what makes remote monitoring and app payments possible, but it also creates risks that operators must manage.
What attackers might target
- Charger control: remotely stopping sessions, changing settings or disabling chargers.
- Payments and personal data: card details, phone numbers and charging history.
- Fraud: free charging through cloned cards or tampered QR codes.
- The wider network: using a weak charger to reach the operator's systems.
- Physical tampering: opening chargers to access ports or swap components.
Secure communication
- Encrypt the connection between charger and management system.
- Use OCPP 2.0.1, which defines security profiles, or secure configurations of OCPP 1.6J.
- Authenticate each charger with its own credentials or certificate, never a shared default password.
- Keep charger traffic on isolated networks, such as a private mobile network or VPN.
Firmware and updates
- Only install signed firmware from the manufacturer.
- Apply security updates promptly and track which version every charger runs.
- Remove unused services and close debug ports before deployment.
Payments and data
- Use established, compliant payment providers rather than handling card data yourself.
- Collect only the personal data you need, and protect it in storage and transit.
- Check QR codes regularly so drivers are not sent to fake payment pages.
Access control
- Give staff role-based access to the management system, with strong passwords and two-factor login.
- Remove access promptly when people leave.
- Keep an audit log of remote commands and configuration changes.
Detect and respond
- Monitor for unusual activity: unexpected restarts, configuration changes or traffic.
- Have an incident plan: who decides, who isolates affected chargers, who informs drivers.
- Report cyber incidents to CERT-In as required, and follow its advisories.
Questions to ask suppliers
- How are chargers authenticated, and is communication encrypted?
- How long will you provide security updates?
- How do you handle reported vulnerabilities?
EVee Buddy runs chargers on isolated connections, with role-based access and monitored firmware across the network. See also OCPP and open standards.
Sources
Security requirements and reporting rules change. Check current CERT-In guidance and your suppliers’ security documentation.