The hidden credit business within EV charging

When CPOs think of fraud, they usually picture the visible kind. A fake QR sticker on a charging station, a terminal that has been tampered with, or a cloned charge card presented at one of their charging stations. Although these risks are real, most CPOs have protocols set to ensure protection.

The bigger problem lies in the smaller moves. When a customer has valid credentials, correct authorisation, and clean session data, nothing seems out of the ordinary. But if the intentions are bad, what happens next is that the invoice is never paid because the account behind it was never real. On top of that, CPOs deal with losses unrelated to fraud, such as incorrect customer data, failed direct debit payments, and disputed charges. Those two problems combined will create a similar reconciliation problem without ever setting off an alarm.

The main risk lies within timing. Ad-hoc card payments are largely secured upfront through pre-authorisation. But once a session is charged to an account, a charge card, an app subscription, or a roaming agreement, the CPO is extending credit. Most CPOs never plan on running a credit business, but it happens regardless.

Why is this problem more difficult in EV charging?

The EV charging business is developed enough for most CPOs to understand the fragmentation it experiences. A single session goes through a driver, a CPO, an MSP, a roaming platform, a CMS, and a PSP. Each of these parties has their own expertise, which is why they only see their own fragment of the transaction.

This fragmentation is exactly where losses hide. However, it does not explain why they are so hard to contain. That comes down to four things:

• The cost of goods is immediate and unrecoverable. The energy is consumed the moment it is delivered. There is nothing to repossess and no service to switch off retroactively.
• Authorisation confirms a credential, not a payer. A valid token proves someone holds a working card or account. However, it says nothing about whether the person behind it is real or intends to pay. The authorisation likely was not even issued by the CPO delivering the energy.

• Roaming compounds the exposure. A single unverified account can charge across multiple networks and countries before the first failed payment surfaces anywhere at all. By then, the costs have accumulated across several counterparties.

• The evidence scatters. When a dispute finally arrives, the session record sits with the CPO, the account data with the MSP, and the payment status with the PSP. Reconstructing what happened takes time, and time is what these people exploit.

Where you are located within that chain determines which of these risks lands on you. A CPO running public infrastructure carries a different exposure from one issuing its own charge cards. With the infrastructure changing, many CPOs now do both, which means they also carry both risks.

How CPOs manage the risk today

The exposure spans throughout the whole transaction lifecycle, and as a result, the controls do too. Before a session, identity verification and credit limits determine how much financial access a new account receives. Tamper checks and terminal inspections protect the hardware on site. During a charging session, transaction monitoring flags anomalies such as a token charging in two different locations during the same day.

Multi-factor authentication and sign-in alerts ensure compromised credentials stay out of the back office. Roaming agreements and settlement terms cover how much exposure any single partner can create between different parties. Once a session is finished, reconciliation connects charging data to invoices and payments, which turns isolated incidents into visible patterns.

These controls operate across teams, and they are always customisable. One option is to turn them all to a maximum, and you will most definitely stop fraud. However, you will also lose a good share of legitimate customers as they face baseless friction. The good news is that most customers are honest; therefore, the real skill is not running all protective measures at full strength but rather knowing how far you should turn each control, for which customers, and at which moment.

How Road approaches fraud

Road has built these measures in the platform itself rather than leaving CPOs to assemble them on their own. CPOs work with multi-factor authentication and security alerts that flag every sign-in from an unrecognised device, with time and location stamps. On top of that, there are account roles that limit what each user can see and change, with full session overviews connecting charging activity to timing and cost, so anomalies stand out. Account-level verification and credit limits that manage how much financial trust a new customer receives, and when.

The last one really stands out, as it addresses the exposure CPOs often overlook. This mostly applies to CPOs who issue charge cards or app accounts under their own brand. Not every CPO does, but the number of those who do keeps growing. This is often the least instrumented part of the risk picture.

Trust Tiers grew out of Road’s own experience as a CPO at scale, which is where the design principle comes from: trust should be earned progressively, not granted upfront.

How Trust Tiers works

Partner with your CPMS provider

Trust Tiers answers one kind of exposure, as the principle behind it travels much further than verifications and account limits. Tighten controls where the risk is highest and keep them light everywhere else. The same logic works for roaming partner exposure, session monitoring thresholds, and back office access.

Losses will always be there alongside the market, and that is not necessarily a reason for alarm. But it is a reason to act before they find you. The good news is that most CPOs do not have to build anything. The measures often already exist within modern charging management platforms, often switched off or left on defaults that were never matched to the CPO’s actual risk profile.

This is where you start. Sit down with your CPMS and go through it together: which controls are available, which ones are switched on, and which ones are still running on settings nobody has revisited since they were installed. The CPOs who manage this well will not be the ones with the most controls; they are the ones who set them right.