The Charger That Charged More Than the Car: How a Copycat EV App Harvested Drivers’ Payment Details in Kingston

KINGSTON, Ont. — November 3, 2026 — The charger worked, the car charged, and the app looked exactly right. When drivers at a fictional Kingston charging station opened their statements days later, they found charges they had never made — for sessions they had never started, at stations they had never visited. The charger had not overcharged them. The app they had used to start it was never the charger’s app at all.

The problem was not in the charging station itself. It was in the app drivers found first: a copy of the fictional charging network’s app, listed in app stores under a nearly identical name, with the same colours, the same logo shape, and the same start-charging button. Drivers who searched for the network’s name, tapped the first convincing result, and signed in handed over their payment card, their email address, and their car’s location history before the first kilowatt ever flowed.

The session had not been overbilled. It had never been booked through the real app.

According to the fictional network’s account, the pattern emerged only when several drivers compared statements. They had all charged at different stations around Kingston, but the extra charges shared a pattern — small, regular amounts, taken days after the real charging session, from a payment profile none of them remembered creating. Staff traced the complaints back to a single step the drivers had in common: they had all downloaded the app in a hurry, standing beside the charger, rather than from the network’s own website or a link printed on the station.

“We tell drivers to plug in and go, and that is exactly what they did,” said Ellen Voss, the fictional charging network’s operations lead. “Nobody expects to have to inspect an app the way you would inspect a card reader. But someone built a copy of our front door, put it at the top of the search results, and collected the keys as drivers walked in.”

Copycat apps are a quiet, growing target for payment fraud.

Technology and payments advisors say charging apps are attractive precisely because they are used in a hurry, outdoors, and under pressure to get moving. A driver low on charge is not in a mood to check a developer name letter by letter, and a copycat app does not need to break into anything — it only needs to look familiar enough to be trusted with a card, and then to pass the driver through to a real charging session so nothing feels wrong.

“The app did exactly what it was designed to do. It started a charge,” said one payments-fraud advisor familiar with copycat app cases. “The attacker did not need to hack the charger or the car. They only needed to stand between the driver and the payment page, and let an honest top-up do the rest.”

In this fictional case, the damage was not a single dramatic theft. Individual cards were charged in amounts small enough to slip past a quick glance at a statement, and the network estimates several thousand dollars was taken in total before the copycat app was removed. For drivers, the loss was compounded by the extra exposure — card details, email addresses, and the location history of their cars, all handed to a stranger in the moment they were simply trying to get home.

The fictional network says it has since changed how drivers find its app. The real app’s name and developer are now printed on every charging station, with a QR code that links only to the network’s own site, and staff check app-store listings weekly for lookalikes, the way they check the stations themselves. Drivers who used the copycat app are being asked to remove it, change any password they reused, and check statements for small charges in the days after a charging session.

The fix, experts say, is deliberately unglamorous: get the app from the source, not the search result.

That advice applies well beyond one charging network. Across Canada, drivers, diners, travellers, and shoppers all download apps in the moment they need them — for parking, for food, for transit, for charging — and most app-store searches return a convincing copy alongside the real thing. The defence is not a cleverer app store. It is a habit of checking where the app came from before handing it a card.

For drivers, the checklist is short: download a charging app before you need it, from the network’s own website or the link printed on the station, check the developer name exactly, and be suspicious of an app that asks for a full card and location history before it has ever charged your car. For app publishers, it is equally simple: print the exact app name and developer on the hardware itself, monitor app stores for lookalikes, and give customers a simple way to report a copy.

The fictional network says affected drivers are being refunded where a statement confirms an unauthorised charge, and the copycat listings have been reported for removal.

The car charged as normal. The app that started it was never the network’s. And the difference — one developer name, checked before the card was entered — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.