RFID Card For EV Charging: The Authorisation Layer Operators Must Get Right

RFID Cards And Charging Authorisation

A driver taps, the ring light turns green, the contactor closes. In between sits a question a charge point operator answers thousands of times a day: may this token draw power here, right now? An RFID card for EV charging is the cheapest way to ask it — and the easiest layer to get wrong, because it looks like a payment instrument and is not one.

Scope, plainly. How drivers pay is covered in our guide to EV charging payment options; forecourt tills and fleet-card acceptance in POS integration for fuel retailers. This post is the layer underneath both — authorisation: proving who may start a session, before any money moves — for CPO technical and operations leads and the account manager issuing cards at scale.

What Happens When An RFID Card For EV Charging Is Tapped

Only the first step happens at the charger. The reader lifts a number off the card, the station sends an authorisation request to the backend and waits, and only when the answer arrives does the transaction start. In OCPP 1.6 that number travels as one field — a case-insensitive string of at most 20 characters which, in the Open Charge Alliance’s wording, “might hold the hidden id of an RFID tag, but can for example also contain a UUID”. One field, one token type.

The answer is one of five values and only one is a yes: Accepted, Blocked, Expired, Invalid, ConcurrentTx. Surface all five, because “the card isn’t working” is four different tickets: a decision someone made, a lifecycle failure you own, an enrolment that never completed, or a token already charging elsewhere — on shared corporate cards, a policy question rather than a fault.

OCPP 2.0.1 typed that identifier and widened it: RFID becomes one method among several, alongside start buttons, remote start from the CSMS and AutoCharge (MAC-address identification). ISO 15118 Plug & Charge drops the card entirely, the vehicle presenting a contract certificate and an eMAID instead — see our ISO 15118 roadmap. Either way the credential you operate is the token record, not the plastic — a question about your OCPP-compliant charging software, worth verifying in the backend.

Central Or Local: Who Answers When The Backend Is Unreachable

The assumption that breaks sites is that rows two and three exist. Under the Open Charge Alliance’s OCPP 2.0.1 certification programme, Core is the only mandatory profile — Smart Charging, Advanced Security and ISO 15118 Support are optional — and Local Authorisation List management is optional inside Core. The OCA’s paper on resource-constrained chargers explains why: a local list needs persistent storage, so a lightweight build drops list and cache and leans on remote start. A charger can be certified and still unable to hold your whitelist. Ask for it by name at procurement, with the maximum entries per station — a 12,000-card programme does not fit a 1,000-entry list.

Then the configuration nobody plans until it bites: one setting lets a disconnected station answer from its own list and cache, a second lets it accept a token it has never seen. That second flag is the whole offline trade-off.

Card Lifecycle At Scale: Issuing, Mapping And Revoking

An RFID card for EV charging is a plastic carrier for a number. The asset is the mapping between that number and an account — tariff, credit terms, parent organisation — and it belongs in a data model you control. Export token, account, group and tariff as one table and a platform change is a data load; leave the card base in a vendor’s console and it is a re-enrolment campaign.

Issue in batches, with a group from day one. OCPP’s authorisation reply carries status, expiry and group id precisely so one customer’s 60 cards behave as a single object: suspend the account and all 60 stop. Retrofitting groups onto flat tokens means touching every record, usually while a customer waits.

Revocation is where theory meets the support desk. Deactivating a lost card is instant in the backend; the exposure is the gap at the charger, which keeps honouring it from cache or local list until told otherwise. Two levers close it: OCPP’s token information carries a cache expiry — a time after which the token must be treated as invalid — so set it short, and push a list update on revocation rather than waiting for the nightly sync. Clearing expired identifiers, the OCA notes, is the backend’s job, not the station’s.

Everything downstream hangs off that record: the token identifies the account, the account carries the tariff, the session becomes an invoice line through your payment and billing software. For corporate and EV fleet charging management customers that chain is the product — which is what a charging management system like YoCharge exists to hold in one place.

Security: What An RFID Card Actually Proves

On its own, not much. Under ISO/IEC 14443 — the contactless standard these cards run on — the card announces its unique identifier during anticollision, before any cryptographic exchange. A reader treating that UID as the credential trusts a number the card hands to anything that asks, and cards that present an arbitrary UID are commodity hardware. Bare UID-based cards are cloneable.

Size the mitigations against what that is worth — a cloned token runs until the account holder disputes it, so one billing cycle postpaid or the remaining balance prepaid — not against the possibility of cloning, which is certain.

On a public network, cap what an unverified token can commit with per-session energy and spend limits, and alarm when one identifier appears in two places at once — ConcurrentTx is that signal, and it catches a clone faster than a complaint does. On a closed depot, specify cards and readers that perform a cryptographic challenge-response rather than presenting a UID: a reader capability, so a procurement decision no CSMS can retrofit. Never print the identifier on the card. Certificate-based identity is the durable answer, but Plug & Charge covers CCS vehicles while India’s demand is overwhelmingly two- and three-wheelers: cards will stay in service for years.

The Operator Checklist Before The Next Card Batch

India’s Ministry of Power guidelines list RFID tags as a component of charging infrastructure and require public stations to offer prepaid and postpaid options — and prepaid is where authorisation and settlement separate. Six things to confirm before the next batch is printed.

Frequently Asked Questions

Sources: Open Charge Alliance — Using ISO 15118 Plug & Charge with OCPP 1.6 | OCA — OCPP 2.0.1 Certification Profiles | OCA — OCPP for Resource-Constrained Devices | Ministry of Power — EV Charging Guidelines, 2024