--- title: "1,114 Free EV Charges and the Trail They Left" url: "https://florea.xyz/ppc-blue-ev-charging-fraud/" date: "2026-11-11T21:39:11+02:00" updated: "2026-11-11T21:39:11+02:00" author: "Bogdan Florea" topic: "Security" --- # 1,114 Free EV Charges and the Trail They Left On November 9, officers from the Bucharest police's cybercrime unit searched 30 homes in a case that sounds like something cooked up in a group chat. Forty-seven people are under investigation for theft and computer forgery over how they charged electric cars at PPC Blue, the charging network run by the energy company PPC in Romania. According to Romania's General Prosecutor's Office, between June 3 and September 30, 2025, the group created 1,114 user accounts in the PPC Blue app. They used temporary email addresses, made-up personal data, fake personal identification numbers and virtual bank cards issued by providers outside Romania. Those accounts were used for 1,114 charging sessions that were never paid for. Prosecutors estimate the loss at 158,355.31 lei. ([Prosecutor's Office statement, in Romanian](https://www.mpublic.ro/index.php/ro/comunicate-de-presa-piccj/2026-11-piccj/c-2026-11-09-08-44-54)) A search doesn't establish guilt, and the statement itself stresses that everyone investigated is presumed innocent. The method it describes is still worth understanding, both for anyone tempted by a cheap shortcut and for any business that takes payments in an app. **TL;DR** - Investigators say the app let a second charging session start within 24 hours without a new card authorisation. A small paid session opened the door to a large unpaid one. - That's a business rule, not a coding slip: someone decided how much trust an account had earned, and anonymous accounts got too much. - Every unpaid session was still recorded, with a time, a station, an account and a card. Digital shortcuts leave evidence by design. - If you run a pay-as-you-go service, reconcile what you deliver against what you collect, every day. ## How the scheme reportedly worked Prosecutors say the mobile app had a weakness. Within 24 hours of a first charging session, the same account could start a new one without a new bank authorisation. The method followed from that. Start a session, let a small transaction be authorised, then stop it quickly. Start a second session and draw far more energy, with no payment taken. According to investigators, the people who created the accounts passed them on to others, who paid them less than the operator's tariff to charge their own cars. It was organised over WhatsApp, and the money moved through transfer apps. Online, this kind of thing gets called a bug. Prosecutors call it theft and computer forgery. ## The bug was a business rule I don't know how PPC Blue's system is built, and the prosecutors' description is the only public account of the flaw. But what it describes isn't a typo in the code. It's a decision about trust. Letting a returning customer start a second charge without a new card check is a convenience, the kind of rule that makes an app feel smoother. In effect, it extends credit: a small paid session earns the account a much larger unpaid one. That's reasonable for a customer whose identity and card you have reason to trust. Here, according to investigators, the identities were false and the cards were virtual cards from abroad. Credit given to an account like that is credit given to nobody. Every pay-as-you-go service has rules like this: grace periods, offline modes, "pay later", a pre-authorisation smaller than what the customer can actually consume. They're usually written as product decisions and rarely reviewed as financial exposure. I'd review them that way: - What's the most a single account can consume without a fresh payment authorisation? - Does that limit depend on how much trust the account has earned, through successful payments over time, or is a brand-new account treated like a regular? - What happens when the authorisation runs out mid-session? It should end the session, not let it run on. ## Reconcile what you deliver against what you collect The other question is how long a leak can run before someone notices. The period in the prosecutors' statement covers almost four months. A charging network knows how much energy each station delivered, and to which session. Finance knows how much money was collected. Putting the two side by side, per session and per day, is one of the simplest fraud controls there is. A session that delivered energy and collected nothing should show up the next morning, not at the end of the quarter. The pattern here would also have stood out: more than a thousand new accounts, each with one paid session that stopped almost at once and one long session that was never paid, many of them signed up with throwaway email addresses and foreign virtual cards. None of those signals proves fraud on its own. Together, they're worth an alert. By the time a weakness is being sold on WhatsApp, plenty of people know about it. A clear way to report flaws, and a habit of acting on reports quickly, gives the operator a better chance of hearing about it first. ## The trail doesn't go away The other half of the story is for anyone who thinks this is a harmless shortcut. Siphoning diesel out of a bus's tank with a hose left no logs. Charging does. Each of those 1,114 sessions has a time, a station, an account and a card attached to it, and apps usually record which device and network connected as well. Fake names and temporary email addresses don't erase that. They add to the case: the investigation is for computer forgery as well as theft. The sessions ran in 2025. The searches came in November 2026. Investigations take time, but the records wait. ## What I'd take from it If your business takes payments in an app: 1. Review every convenience rule in the payment flow as a credit decision, with a maximum exposure per account. 2. Make new, unproven accounts earn trust before they get grace periods. 3. Reconcile what you delivered against what you collected, every day. 4. Give people a way to report flaws, and act on what they send. And for everyone else: if an app lets you take something without paying, that isn't a clever trick. It's a record that points back to you, even when the name on the account is fake.