Warning - EVGo AutoCharge

[bhopkins]

Saw a $47.80 charge hit my credit card from EVGo. The Rivian has been parked in the garage all day. Opened the EVGo app and found a charging session at the Flying J, Matthews, MO more than 600 miles from me. In looking at the app, I had enrolled my R1T in the autocharge program years ago But had forgotten about that. Earlier this year, I traded that Rivian for a 2026 model but never thought to unenroll the old vehicle. I assumed that when a vehicle was traded in via Rivian that everything would be reset.

In talking with EVGo, they said the autocharge program only looks at the vehicle’s VIN and charges whatever account it was tied to. Seems like really poor system security on EVGo‘s part. Needless to say, I have unenrolled the old vehicle and removed my credit card from the EVGo app.

if you’ve trade in or sold a previously enrolled vehicle, you may want to check k your EVGo account and make sure it is not still enrolled.

Sponsored

 

[CharonPDX]

Yeah, I posted about the potential security concerns of AutoCharge a while ago. While it does function, it's not the most secure system. This is a key example of one of the problems with it.

When I sold my Mach-E, I made sure to remove it from my EVgo account while I was waiting for the Uber to take me home.

Definitely a good thing to keep in mind! Maybe we should have a "tasks when you sell your Rivian" as a sticky thread?

 

[Manalishi]

Sticky thread for selling/lease return tasks is a good idea.

 

[SuperNintendoChalmers]

Same exact same thing happened to me on my last Hyundai lease. Thankfully it was only $5, but it's definitely an issue.

 

[bhopkins]

EVGo has graciously offered to refund the charging fee as a one-time courtesy. The email also goes on to say ”Please note: We typically cannot issue you a refund on any transactions initiated through Autocharge+. Part of the noted disclaimer when enrolling for Autocharge+ is to unenroll the vehicle from your account when the car is returned. If still enrolled after returning the vehicle, you are subject to all subsequent charges.”

they’ve handled it well. I just think their system design stinks. If I use them in the future, I’ll just start the charge from the app.

 

[Dave Cundiff]

Thanks so much, @bhopkins!

I just opened the EVgo app, opened the triple line in the upper left, and deleted the vehicle we recently sold. That should prevent this problem for me. I wouldn't have thought to do this without this thread.

Best wishes!

 

[Zathras]

I don't see any issues with this. Tying to the VIN is safe since it gets it dirextly from the vehicle. It just requires some diligence when the car is sold. We appreciate you making this known.

 

[godfodder0901]

I don't see any issues with this. Tying to the VIN is safe since it gets it dirextly from the vehicle. It just requires some diligence when the car is sold. We appreciate you making this known.

Getting the VIN from the vehicle isn't really 'safe' if there is no verification. Someone so inclined could easily spoof a VIN.

 

[Zathras]

Getting the VIN from the vehicle isn't really 'safe' if there is no verification. Someone so inclined could easily spoof a VIN.

How do they get your VIN tied to your account? What are the chances anyone is a victim? What security measures are involved? How does it confirm the VIN is legit? What does the handshake involve to prove it’s you?

You don’t think they thought of these things? I suspect if Google can track us across the web by the hardware footprint of our phones, the same thing could happen here. They got this charge from a vehicle legitimately, though unintended, that was still tied to the previous owner. Ever hear of anyone getting charged by a spoofed VIN?

 

[godfodder0901]

How do they get your VIN tied to your account? What are the chances anyone is a victim? What security measures are involved? How does it confirm the VIN is legit? What does the handshake involve to prove it’s you?

You don’t think they thought of these things? I suspect if Google can track us across the web by the hardware footprint of our phones, the same thing could happen here. They got this charge from a vehicle legitimately, though unintended, that was still tied to the previous owner. Ever hear of anyone getting charged by a spoofed VIN?

Getting the VIN could be as easy as looking in your window while you're charging. They could also use OSINT (you can find hundreds of VINs on this site alone).


https://teslamotorsclub.com/tmc/threads/unexplained-supercharger-card-charges-from-tesla.353786/

 

[CharonPDX]

Getting the VIN from the vehicle isn't really 'safe' if there is no verification. Someone so inclined could easily spoof a VIN.

It is.

https://www.rivianforums.com/forum/threads/evgo-warning-insecure-service.18518/

https://github.com/uhi22/pyPLC

https://www.macheforum.com/site/thr...evgo-just-had-a-few-fraudulent-charges.30555/

Sponsored