A locked connector cannot protect an entire charging site. EV charging station security requires physical protection, controlled charging permissions, secure connected equipment and a tested response when something goes wrong.
Cable theft can leave bays unavailable long after the offender has left. For fleet operators, property managers and charging networks, the practical task is to identify exposed assets, assign responsibilities and protect service availability.
Start with the site and its operating hours, then select controls that address the risks.
Key takeaways
- Assess each location separately, including cable exposure, public access, overnight vacancy and the operational consequences of losing several chargers.
- Protect cables with suitable siting, manufacturer-approved security measures and controlled storage, whilst keeping accessible routes and electrical equipment clear.
- Enable charging authorisation through supported app controls, PINs or individually assigned RFID credentials rather than relying on schedules alone.
- Test CCTV and lighting after dark, then assign somebody to review alerts and arrange a proportionate response.
- Separate charger networks from business systems, restrict administrator access and maintain supported firmware, certificates and security logs.
- Prepare an incident procedure covering electrical safety, police reporting, evidence preservation, insurance notification and the controlled return of equipment to service.
Understand what thieves and vandals can affect
Copper theft and equipment damage
Copper is a principal motive for charging cable theft. However, a portable domestic charging lead contains relatively little copper compared with heavier commercial infrastructure. Smart Home Charge’s cable-theft guidance makes that distinction.
The amount recovered by an offender doesn’t determine the operator’s loss. For EV charger theft, replacement cables, specialist attendance, electrical inspection and unavailable bays can cost far more than the recovered copper.
A tethered cable can also be cut rather than removed intact. Damage to one component may require the whole charger to remain unavailable until a competent person establishes its condition.
Fleet World reported that EV charging cable theft more than doubled in 2024. Reporting associated with data shared with DeterTech compares 2024 with 2023, rather than establishing the sometimes-repeated 2025 comparison.
Those reports describe recorded incidents, not the probability of theft at an individual site. Local incident history, access conditions and charger concentration remain necessary for a useful assessment.
Vandalism, misuse and service interruption
Vandalism includes damaged screens, broken connector holders, interference with cabinets and deliberate obstruction of charging bays. Payment labels and customer instructions can also be altered to direct drivers towards fraudulent payment routes.
Unauthorised charging is a separate problem. This form of energy theft uses electricity through equipment that remains physically intact, so cable protection alone won’t address it.
Cyber incidents may affect accounts, payment information, charging availability or administrative control. A locked cabinet offers limited protection against compromised cloud credentials.
Record these threats separately. Theft, accidental impact, misuse and software faults need different evidence and different corrective action. Treating every unavailable charger as vandalism can hide maintenance failures and distort the security budget.
Assess the location before buying equipment
Public hubs, workplaces and fleet depots
Walk the site during normal operations and after dark. The facilities manager should record pedestrian approaches, vehicle access, concealed areas, neighbouring activity and routes used to remove equipment.
Public charging stations need clear sightlines and safe customer access. Hiding chargers behind buildings may reduce visibility from the road, but can also remove observation and leave drivers isolated.
Workplace and fleet charging require stronger separation between authorised users, visitors and contractors. Position charging equipment within the appropriate controlled area, rather than assuming that an outer gate protects every asset equally.
Map the ownership boundaries. A landlord may control lighting, a charging operator may maintain the equipment, and a managing agent may hold CCTV. Assign responsibility for faults and incidents before installation.
Include delivery vehicles and maintenance access in the assessment. A charger beside a service road may face repeated accidental impact even where deliberate theft is uncommon.
Home chargers and residential developments
A home EV charger installed inside a garage is less visible and less accessible to opportunistic thieves. Where that isn’t practical, a position away from direct street view can reduce exposure.
The installation still needs suitable electrical protection, ventilation where required and safe cable routing. Security should influence the design without overriding installation requirements.
Shared residential parking needs a different arrangement. Allocate charging permissions to residents, define visitor access and establish who responds when a cable is damaged overnight.
Remove shrubs, stored materials or waste containers that obstruct observation. Reassess the layout after landscaping changes, new parking arrangements or the introduction of additional chargers. A clear camera view at handover can become ineffective within months.
Choose tethered or socketed chargers deliberately
What a tethered charger protects
Its cable is permanently attached to the charging unit. This makes it harder to remove intact than a loose lead left beside a socketed charger.
It also reduces the need for drivers to handle and store their own cable. That can suit workplace pools and fleet operations where consistent equipment matters.
Permanent attachment doesn’t prevent cutting, connector damage or interference with the charger housing. A tethered unit beside an unrestricted footpath still presents an exposed asset.
Review the replacement arrangement during procurement. Cable damage may require an engineer, compatible parts and a period of downtime. The maintenance contract should identify response and restoration responsibilities.
Cable length also matters. A longer lead may serve more vehicle positions, but excess cable creates additional handling, storage and damage problems. Select a length suited to the bay layout.
What a socketed charger protects
A socketed charger allows the user to bring a detachable cable. Removing and storing that cable after charging can reduce the equipment left exposed when the bay is vacant.
Many vehicles lock the connector during charging. Some socketed chargers also retain the cable at the charging-unit end, but the behaviour depends on the equipment and settings.
Smart socketed chargers may support smartphone authorisation, PINs or cable-retention controls. These functions serve different purposes: permission to start charging doesn’t automatically mean the cable remains mechanically locked.
Record the intended behaviour during commissioning. Establish what happens during charging, after charging finishes, during a communications failure and when the vehicle unlocks. Drivers need a clear release procedure that doesn’t encourage force or improvised handling.
Protect cables without creating new hazards
Use compatible physical protection
Select protective equipment approved for the charger and its installation conditions. Lockable covers, protective housings and cable-management systems can restrict access or reduce exposed cable, but suitability varies.
Avoid improvised chains, padlocks or wheel-spoke arrangements that strain connectors, obstruct vehicle movement or interfere with safe disconnection. A security accessory should not introduce a trip hazard or damage insulation.
Bollards can protect chargers against accidental vehicle impact when correctly designed and positioned. Ordinary parking bollards should not be described as protection against deliberate vehicle attack without suitable performance evidence.
Keep ventilation openings, emergency controls and maintenance clearances accessible. Protective cages that obstruct servicing can encourage staff to leave them open, removing the protection they were bought to provide.
Manage cables between charging sessions
A cable left across the ground is exposed to vehicle damage, contamination and unnecessary handling. Provide suitable holders or manufacturer-approved management systems and include cable condition in routine inspections.
Public sites should provide an obvious resting position for unused connectors. Fleet depots should allocate responsibility for returning cables after each charging session or shift.
At socketed public stations, drivers should use the vehicle’s supported locking function and remove their own lead when finished. Do not leave spare cables unattended in the bay.
Keep replacement cables and components in controlled storage. Record issues and returns, particularly where several contractors maintain the same estate. An unexplained missing spare can otherwise be mistaken for routine maintenance use.
Make CCTV and lighting produce useful evidence
Specify the view required
CCTV coverage should answer defined questions: who approached, which charger was affected, what happened and which route was used to leave.
A wide view of an entire car park may show movement without providing enough detail to identify a person or vehicle. Combine general coverage with views of charger approaches, payment areas and relevant access points.
Test recorded footage under working conditions. Darkness, rain, vehicle headlights, glare and parked vans can make a satisfactory daytime image unusable.
Synchronise camera clocks with access-control and charging-system records. Matching events becomes harder when each system records a different time.
Establish an export procedure before an incident occurs. Authorised staff should be able to preserve usable footage, retain the original recording and record who handled the files.
Set retention around a documented purpose and realistic incident-discovery period. There is no universal statutory 31-day minimum for every commercial CCTV system. Longer storage is not automatically more useful or more lawful.
Light people and routes, not just equipment
Motion-sensor lighting can discourage concealed activity and improve footage when someone approaches a charger. It should complement wider illumination rather than leave customers moving through darkness between activations.
Direct light towards approaches, pedestrian routes and the areas cameras need to observe. Excessive brightness can obscure faces, create glare and disturb neighbouring properties.
Maintain planting, clean camera lenses and repair failed fittings promptly. A security plan that depends on a clear view also needs somebody responsible for keeping that view clear.
Remote CCTV monitoring can connect a verified event with an escalation procedure. Recording alone preserves evidence; live assessment may create an opportunity to intervene safely.
A recording can establish what happened. Prevention also depends on detection, a decision and an available response.
Use clear surveillance signs and appropriate privacy information. Signs should describe measures that exist, rather than imply that an unmonitored site has continuous live supervision.
Assign a response to every significant alert
Define monitoring and attendance duties
A charger tamper alert, camera notification or cabinet alarm needs an identified recipient. The operating plan should state who reviews the event, who can contact the site and who can arrange attendance.
Remote operators should distinguish expected maintenance from suspicious activity using current work orders and contact details. An engineer opening a cabinet and an offender interfering with it may initially produce similar alerts.
Define escalation for lost communications as well as confirmed intrusion. A silent charger or camera may indicate a technical fault, power loss or deliberate interference.
Use security guarding and patrol support where site risk justifies physical attendance. Patrol frequency, inspection points and reporting duties should follow the location’s exposure.
Plan for vacancy and safe attendance
Night-time vacancy, weekends and holiday closures remove routine observation. Review cover for those periods rather than applying weekday assumptions to an empty site.
Provide authorised responders with controlled access arrangements and current site information. A locked gate should not leave an attending responder dependent on an absent tenant.
Attendance instructions must prioritise personal safety. Security staff should observe, report and follow the agreed escalation procedure rather than confront suspected cable thieves.
Record attendance times, findings and outstanding defects. A patrol report that states only “all secure” provides little help if a charger was already damaged or a camera had failed.
Review repeated false alerts. Excessive notifications can reduce attention to genuine incidents, so detection settings and maintenance faults need follow-up.
Stop unauthorised charging and electricity use
Require permission to start a session
Before making a private charger available, enable the supported access controls on your smart charger. Depending on the product, authorisation may use a smartphone app, PIN, RFID card or another approved credential.
Assign credentials individually where practical. Shared PINs are difficult to withdraw from one former employee, contractor or resident without affecting everyone else.
Remove permissions when a person leaves, changes role or loses an access card. The fleet manager or property manager should own that process, rather than leaving it to informal requests.
Physical entry and charging permission should remain separate decisions. A visitor allowed into a car park doesn’t automatically need access to workplace charging.
Where entrance permissions also need attention, commercial access control installation can support defined tenant and restricted-area boundaries. The charging platform still needs its own authorisation rules.
Treat schedules as an additional restriction
Charging schedules can prevent use outside configured hours when the equipment enforces that restriction. They’re useful for tariff management and limiting availability during unattended periods.
A schedule alone doesn’t distinguish an authorised vehicle from an unauthorised one during an open window. Combine time restrictions with session authentication.
Account for legitimate exceptions, including shift changes, delayed fleet returns and emergency journeys. Unworkable restrictions often lead staff to disable controls or circulate shared credentials.
Review session records for unexplained consumption, repeated rejected starts and activity outside expected operating patterns. Investigate possible energy theft before drawing conclusions, as scheduling errors and incorrect account allocation can produce similar results.
Document how the charger behaves offline. Some systems permit previously authorised users or apply locally stored rules when the management platform is unavailable.
Secure connected chargers and their accounts
Restrict administrative access
A smart charger app can prevent casual unauthorised use, but its effectiveness depends on account security and the service behind it. App control is not a guarantee against hacking or account compromise.
Use unique credentials and enable multi-factor authentication wherever the platform supports it as basic cybersecurity controls. Separate routine user access from permissions that change tariffs, enrol chargers or alter security settings.
Give maintenance contractors only the access needed for their work. Remove temporary accounts after completion and record changes to administrative permissions.
Connect chargers through a network separated from ordinary office systems and guest Wi-Fi. Network segmentation limits unnecessary communication and can reduce the consequences of a compromised device.
Use supported firmware versions and a controlled process for firmware updates. Record installation outcomes, failed updates and equipment approaching the end of security support.
Include third-party platforms in the assessment
Charging infrastructure includes more than the equipment in the car park. Apps, cloud management services, payment providers and maintenance portals may hold customer information or privileged access.
In November 2024, reporting described an exposed dataset containing approximately 116,000 rows associated with EV charging services. Cybernews’ investigation of the claimed Tesla leak explained that attribution to Tesla was unsupported and pointed towards third-party charging services.
The reported rows should not be presented as a confirmed count of unique customers. Nor does the incident establish that every affected charger was physically compromised.
The procurement consequence is clear. Require defined data-handling responsibilities, incident notification arrangements, administrative logging and a process for withdrawing a supplier’s access.
Retain only the customer information required for the service. A smaller data holding reduces the information exposed if an account or platform is compromised.
Understand what charging security standards establish
OCPP secures charger-to-platform communication
The Open Charge Point Protocol, or OCPP, supports communication between charging stations and their management systems. Its version number doesn’t establish how securely a particular deployment operates.
OCPP 2.0.1 incorporates security functions into the core specification, including security-event logging, certificate management and support for signed firmware updates. Mutual TLS authentication is supported through Security Profile 3.
Mutual authentication means the charger and management system establish each other’s identity using certificates. Don’t assume it’s active just because a product advertises OCPP 2.0.1.
OCPP 1.6 can use additional protections described in the Open Charge Alliance’s separate security guidance. Those improvements are incorporated into the later framework, but aren’t automatically active in every older installation.
The Open Charge Alliance’s regulatory mapping connects protocol functions with relevant British smart-charge-point requirements. Procurement should specify the required security profile and request evidence of implementation.
ISO 15118 and NIST address different functions
ISO 15118 covers communication between the vehicle and charging equipment. Plug & Charge uses certificates and Public Key Infrastructure, or PKI, to establish trusted identities; TLS protects relevant communications.
Keep that certificate system separate from charger-to-platform authentication and firmware signing. Claiming that ISO 15118 requires signed certificates for every charger firmware update confuses different security functions.
Firmware updates need their own authenticity and integrity controls. Signed firmware lets equipment check whether an update comes from an accepted source and has been altered.
NIST IR 8473 provides a Cybersecurity Framework Profile for extreme fast charging infrastructure. It considers vehicles, charging infrastructure, cloud or third-party operations, and utility or building networks.
It’s voluntary risk-management guidance, not a UK legal requirement. UL 2594 covers EV supply-equipment safety rather than cybersecurity. Check a supplier’s UL 2594 claim against the exact product and market. Evidence for UL 2594 doesn’t establish that security controls are configured or active.
Apply the correct British regulatory requirements
Separate the commencement dates
The Electric Vehicles (Smart Charge Points) Regulations 2021 introduced requirements for relevant private charge points sold in Great Britain.
Most requirements took effect on 30 June 2022. The additional Schedule 1 security requirements took effect on 30 December 2022.
The distinction matters. Saying that every new UK home charger needed all security provisions from June 2022 misstates both the dates and geographical scope.
The government’s smart charge point regulations guidance identifies the covered products and exclusions. The regime applies to relevant domestic and workplace equipment in Great Britain, rather than every public charger throughout the UK.
Existing equipment is not automatically upgraded because a later sales requirement takes effect. Asset registers should distinguish equipment age, supported capabilities and the obligations applying to the installation.
Treat product compliance as a starting point
Covered equipment has requirements addressing passwords, secure updates, protected communications, software integrity, tamper protection and security logging.
Secure Boot addresses software authenticity during start-up. It does not protect an exposed cable against cutting or establish that a remote monitoring service will respond.
Avoid broad claims that UK and EU rules impose identical Secure Boot requirements on every charger. Different product regimes have different scopes, duties and implementation dates.
Likewise, compliance evidence for the charging product does not establish the security of the surrounding site. Lighting, access, maintenance, monitoring and incident response remain operating responsibilities.
Keep the supplier’s conformity documentation alongside commissioning records and the asset register. The facilities manager should be able to connect each installed unit with its model, serial number, configuration and maintenance history.
Use forensic marking as supporting protection
Forensic marking can help connect recovered cable with a registered owner or location. It adds traceability after an incident and may strengthen a visible deterrent message.
Be.EV’s use of SelectaDNA-coated cables has been reported as part of its response to charging cable theft. The coating carries a unique DNA marker that can help police trace recovered material.
The marker does not physically stop a cable being cut. Recovery also depends on discovery, examination and an accurate registration record.
Record which assets have been marked, where they are installed and who maintains the registration. Update records when cables are replaced or equipment moves between sites.
Use only a marking method compatible with the equipment and its warranty conditions. Staff should not apply unapproved substances to connectors, contacts or cable surfaces.
Treat anti-cut materials, intelligent cable alarms and automated detection claims separately from established operating controls. Their usefulness depends on compatible installation, reliable detection and a response that can reach the site.
A product demonstration establishes that a function can operate under demonstration conditions. It does not establish a reduction in theft across an entire estate.
Set the budget around loss and operating needs
Prioritise measures by exposure
Start with controls that address identified weaknesses: failed lights, unrestricted private charging, missing credentials, obstructed camera views and unclear response duties.
These faults may be cheaper to correct than adding another technology platform. Leaving them unresolved also reduces the value of later investment.
Compare expenditure against the consequences of losing equipment. For a fleet depot, several unavailable chargers may affect vehicle readiness and scheduled work, even where cable replacement costs are manageable.
A public hub needs an assessment of customer disruption, damaged equipment, contractor attendance and the time required to restore capacity. A quiet residential site may justify a different level of monitoring.
The main cost categories should remain visible during procurement.
| Measure | Initial expenditure | Continuing obligation |
|---|---|---|
| Physical protection | Compatible hardware and installation | Inspection, repairs and controlled access |
| Surveillance and lighting | Cameras, fittings, power and connectivity | Maintenance, storage and monitoring |
| Charging authorisation | Configuration and credential provision | Permission reviews and user administration |
| Patrol or alarm response | Mobilisation and site instructions | Attendance cover and reporting |
| Cybersecurity controls | Network design and secure commissioning | Updates, certificates and account management |
The purchase price is only part of the commitment.
Define acceptance before installation
Require suppliers to demonstrate the functions included in the specification. Record charger authorisation, cable retention, night-time images, alert delivery and footage export.
Assign ownership of subscriptions, administrator accounts and configuration records. A departed contractor should not remain the only person able to change settings.
Include equipment failure and supplier exit in the contract. The operating team needs access to its records, credentials and service arrangements if the provider changes.
Establish insurance cover and contractual responsibility
Home insurance does not cover every charger in the same way. Check whether home insurance covers fixed equipment and detachable cables separately. A fixed charging point may fall within buildings cover, whilst a detachable cable may be treated differently under home or motor insurance.
Some policies include charging equipment, whilst others exclude it or impose limits. Review the relevant home insurance policy wording for limits and exclusions. Theft, accidental damage and malicious damage may also have different conditions.
E.ON Next’s charger-protection guidance highlights insurance for charging cables against theft and accidental damage. The applicable policy wording determines the cover, not the fact that the charger stands on a driveway.
Commercial sites need a clear allocation between the landowner, charging operator, tenant and maintenance contractor. Ownership of the parking area does not necessarily establish ownership of the charging equipment.
Record responsibility for replacement equipment, electrical inspection, attendance charges, lost revenue and third-party damage. Avoid assuming that a maintenance agreement includes malicious damage or cable theft.
Keep asset records, installation invoices, maintenance reports and security arrangements accessible to the claims lead. Record relevant limits, excesses and conditions within the site’s insurance summary.
Business interruption cover depends on its terms and insured triggers. An unavailable charger does not automatically create an insured revenue claim.
Reporting duties also need an owner. A delay caused by uncertainty between landlord and operator can complicate evidence collection and restoration, regardless of whether the eventual claim is accepted.
Respond safely after theft or vandalism
After EV charger theft or vandalism, treat any cut, damaged or interfered-with cable as an electrical hazard. Keep people away and arrange an assessment by an authorised, competent person.
A remote stop command doesn’t establish that damaged equipment is electrically safe. Security staff and drivers shouldn’t handle exposed conductors, open cabinets or attempt repairs.
Use a clear incident sequence.
- Restrict access to the affected bay and adjoining areas where damaged equipment could create danger. Call 999 if there’s immediate danger or a crime in progress.
- Notify the charging operator and appointed site lead. Arrange safe isolation and inspection through the authorised electrical or maintenance team.
- Report non-emergency theft or damage through the appropriate police reporting route. Record the reference, location, charger identity and discovery time.
- Preserve CCTV, access records, charging logs and relevant alerts before normal retention periods overwrite them. Record who exports or handles the evidence.
- Notify the responsible insurer and contractual parties, then document repairs and the decision to return the equipment to service.
Photographs can support a report if they can be taken from a safe position. Don’t approach damaged electrical equipment or disturb potential evidence to take them.
Preserve the surrounding context as well as footage of the damaged charger. Video showing the approach and departure may explain more than a close view of the damage.
For suspected account compromise, restrict affected access through the authorised administrator and preserve relevant logs. Don’t delete accounts or reset systems indiscriminately before the incident lead assesses the evidence.
Appoint one person to coordinate restoration. Public availability information, bay closures and fleet charging arrangements should reflect the equipment’s actual condition.
Review the incident after restoration. Identify the failed control, assign corrective work and record its completion before closing the matter.
Frequently asked questions
How can a charger be protected against theft?
Combine secure siting, compatible physical protection, controlled access and a response arrangement. A tethered cable is harder to remove intact, but remains vulnerable to cutting.
For home equipment, garage installation or a less exposed position can reduce opportunity. Public sites need visibility, maintained lighting and protection that does not obstruct safe customer use.
Can someone use a private charger without permission?
Yes, if the equipment allows charging without authentication. A physically accessible charger may accept a session unless its access settings restrict use.
Enable supported app authorisation, PINs or assigned RFID credentials. Scheduling reduces availability outside set hours, but does not prevent an unauthorised person charging during an open period.
Is it safe to leave an EV plugged in overnight?
Overnight charging is a normal use of a correctly installed, suitable charger and vehicle charging system. Follow the manufacturer’s instructions and keep equipment maintained.
Do not use damaged leads, improvised connections or unsuitable extension arrangements. Overnight operation also needs appropriate security controls where the vehicle or charger is accessible to others.
Are app controls and PINs enough to stop hackers?
They can restrict routine use, but do not address every cyber risk. Account security, software support, network separation and supplier controls remain important.
A PIN protects a particular access function. It does not establish that administrator accounts, firmware updates or cloud data are adequately protected.
How should drivers protect cables at public stations?
Use the vehicle’s supported connector-locking function and follow the charging operator’s instructions. At socketed public charging stations, remove and store the personal cable after the session.
Do not add improvised restraints to public equipment. Report broken connector locks, damaged cables or suspicious payment labels through the operator’s established reporting channel.
Keep security tied to service availability
Effective EV charging station security depends on working controls and clear ownership. Cable protection, charging permissions, surveillance and cybersecurity each address different failures.
Assign responsibility for every alert, inspection and repair. Test the arrangements during darkness, vacancy and communications loss, when routine assumptions are most likely to fail.
A charger is protected only while its physical condition, access rules and response arrangements remain effective. Keep those conditions under review throughout the equipment’s working life.
0 Comments