Key facts
- A QR code is a shortcut to a destination, not proof of the payment recipient’s identity.
- Confirm the operator route independently, then match the station and connector.
- HTTPS encryption does not establish that a page belongs to the charging operator.
- IONITY’s stated direct-payment domain is a network-specific example, not a worldwide rule.
- Response steps depend on whether a password, financial information or device access was exposed.
Before paying through a charger’s QR code, verify the operator through a channel you already trust and match the station you are standing beside. A printed logo, a convincing payment form and an HTTPS address are not sufficient evidence on their own. If something is unclear, stop before entering credentials or card details and use a verified alternative.
QR payment can be legitimate. The useful distinction is between a payment route confirmed by the operator and an unverified link. This guide uses an operator example and government cybersecurity advice checked on 12 November 2026; it does not assume one payment system or reporting service applies worldwide.
What can a replaced QR sticker do?
IONITY’s fraud warning describes fake QR stickers leading to imitation payment pages. The operator identifies payment.ionity.eu as its genuine direct-payment domain and points customers towards its official app or available contactless terminals as alternatives. This is an IONITY-specific check, not an approved-domain list for every charging network.
The Canadian Centre for Cyber Security’s QR guidance explains that codes can trigger different actions, including opening websites or downloading files. It recommends examining the destination and checking suspicious overlays. An extra sticker may be a legitimate update, so appearance alone does not settle the question; an undisturbed-looking sticker is not proof either.
Think of the code as an address shortcut. It saves typing, but does not independently establish who placed it there. That distinction is especially useful when you are tired, short of charge or facing a queue.
A two-part check before entering details
1. Establish the payment route independently
Open an operator app you already obtained through a trusted route, or type a known official address. If you need help, find support through that verified channel. A telephone number printed on the same suspicious sticker is not an independent confirmation.
For its own network, IONITY’s QR charging instructions also describe visiting its payment website directly and selecting the charger. Its instructions acknowledge that a bank may request payment authentication. A verification step is therefore not automatically fraudulent; the key is establishing the genuine charging and banking channels before following it.
Where a network uses a separate payment provider, confirm that arrangement through the operator’s official instructions. Do not assume every unfamiliar redirect is malicious, but do not approve it merely because the previous page displayed the right logo.
2. Match the station and the transaction
Compare the verified app or payment page with the physical location, station identifier and selected connector. Check the stated tariff, currency and any session conditions before authorising. This second check reduces the chance of starting the wrong session; it does not replace the first check, because a fake page can copy a station number.
Save the station reference and normal receipt through the genuine service. Our charging-roaming price guide explains why different legitimate payment routes can still quote different prices.
Why the padlock is not a verdict
The UK National Cyber Security Centre’s protocol guidance explains the underlying problem: encryption does not help if the other end of the protected connection is the attacker. HTTPS protects a connection; it does not certify that a website belongs to your charging operator.
Look at the complete destination, not just a familiar word near its beginning. Be wary of a payment process that suddenly asks you to install an unfamiliar app, grant remote access or disclose credentials unrelated to the session. Pause and verify the request through a known channel rather than troubleshooting inside the suspect page.
The U.S. FTC’s September 2026 warning about parking QR codes recommends checking the URL and avoiding unverified payment links. That article concerns parking scams; it supports the verification habit here, not a claim about how often any particular charger is attacked.
A practical decision example at an unfamiliar charger
Imagine arriving with enough reserve for a nearby alternative. The sticker’s page shows a familiar network logo, but the address differs from the operator route you saved before travelling. The station number appears correct.
| Observation | What it establishes | Useful next action |
|---|---|---|
| The logo and station number match | The page contains matching information | Keep checking; matching graphics can be copied |
| The destination is not a route you can verify | The payment recipient remains uncertain | Do not enter details; open the known operator channel |
| The official app offers the same connector | You have a separately established route to that session | Check its tariff and conditions before paying |
| No trusted route can be established | The uncertainty remains unresolved | Contact verified support or use a practical backup |
This is a fictional decision exercise, not a report of a tested charger. Plan the backup before arrival using our guide to charger status and availability. If your reserve or location makes leaving unsafe, seek appropriate assistance rather than treating an unverified payment as the only option.
If you already followed the link
Respond to what was exposed. The Canadian Centre’s social-engineering guidance advises steps such as changing compromised passwords, enabling multifactor authentication and contacting financial institutions when financial information may be at risk. For a work device or account, involve your organisation’s support team.
| What happened | Proportionate next step |
|---|---|
| You previewed a suspicious address but did not open it | Do not continue; use a verified payment route |
| You opened a page but entered nothing | Close it, decline downloads and seek trusted device support if anything was installed or changed |
| You submitted card or banking details | Contact the bank promptly through its official app or a number you independently trust; follow its protection instructions |
| You disclosed a password | Change it through the genuine service, address reuse elsewhere and enable available multifactor protection |
| You installed software or allowed unusual access | Get trusted device or workplace IT help; contact affected financial services if their information may be exposed |
Keep the time, location, station identifier and transaction references you already have. Report the suspected issue to the real operator and the appropriate fraud-reporting service in your country. Do not publicly post passwords, authentication codes or full card details. Refund rights and bank procedures depend on the transaction and jurisdiction; this checklist promises neither a refund nor a universal response time.
Frequently asked questions
Are all charger QR codes unsafe?
No. Legitimate operators use them. Verify the route and session rather than accepting or rejecting a payment purely because it began with a QR code.
Does a pending bank amount prove fraud?
No. Compare the genuine session record with the bank’s transaction status. Our preauthorisation and pending-hold guide separates a temporary reservation from a settled charge. Suspicious exposure still warrants prompt contact with your bank.
Should I remove a suspect sticker?
Report it through verified operator support and follow their instructions. Do not damage or dismantle charging equipment to investigate it yourself.