The Incident in Schwabenheim
A man tried to charge his electric vehicle at a public charging station on the market square in Schwabenheim an der Selz (Rhineland-Palatinate, Germany) on March 9, 2026, according to Mainz police. The station carried a sticker with a QR code that appeared to come from energy provider 'RWE'.
The charging station is in fact operated by 'EWR', not RWE, police said. The man did not notice the discrepancy at first. After scanning the QR code, he was directed not to the operator's website but to a phishing page.
The fraudsters then attempted to charge the man's credit card, police said. The payment was not approved and the man suffered no financial loss. Mainz police are investigating.
How the Charging Station Scam Works
- Criminals place fake QR code stickers over the original codes on public EV charging stations
- The fake sticker carries a well-known brand name (in this case RWE instead of the actual operator EWR)
- When scanned, the code directs users to a phishing website imitating a legitimate payment page
- The fake page requests credit card details or other payment information
- The perpetrators then attempt unauthorized transactions with the stolen data
Warning Signs of Fake QR Codes at Charging Stations
Sticker Over the Original
Check whether the QR code is a sticker placed over another code. Stickers can often be felt as raised edges on the surface.
Mismatched Provider Name
Compare the name on the QR code with the actual operator of the charging station. In the Schwabenheim case, the fake sticker showed 'RWE' while the real operator was 'EWR'.
Unfamiliar URL After Scanning
Check the address bar after scanning. Official charging apps and websites use known domains.
Request for Credit Card Details
Legitimate charging providers do not request credit card details directly via QR codes. Police advise using the provider's official app instead.
Why EV Charging Stations Are Targeted
EV charging stations stand in public places, are usually unattended and display payment QR codes prominently. Users are accustomed to scanning these codes to start charging. Police across Germany have reported similar cases at parking meters, charging stations and public facilities.
Police Recommendations for Charging
- • Use the charging operator's official app for payment where possible
- • Check whether the QR code is a sticker that was added later, for example at the edges
- • Compare the provider name on the QR code with the name on the charging station itself
- • Check the URL after scanning and do not enter payment data on unknown sites
- • Report suspicious QR codes to the charging station operator and the police
QRTrust: QR Code Checks Before Opening a Link
QRTrust checks the destination URL of a QR code before the page is opened. The analysis uses six security layers and detects phishing URLs in real time.
URLs are checked against over 1 million known phishing addresses, supplemented by AI-based pattern recognition. The service is GDPR compliant and hosted in Germany.
Check a QR code with QRTrust →About QRTrust
QRTrust is Germany's first QR code security platform, developed in Dortmund. AI-powered real-time detection, a local threat database and multi-layered security checks protect citizens, authorities and businesses from quishing attacks. GDPR compliant, hosted in Germany.