Three ways to start a charge without an app: scan a QR code, let the car authenticate itself, or tap a card. The regulator has already drawn the map. AFIR mandates a contactless card reader on every high-power public charger — DC, ≥50 kW — deployed from April 2024, with existing units retrofit by January 2027. On lower-power AC sites it permits a QR-based ad-hoc method instead. So the regulation already treats card-present as the baseline where the sessions and the stakes are largest. And even where it allows QR, it is solving for one thing: an ad-hoc payment a first-time driver can complete with no download and no account.
That is the real question. Not “which mechanism is clever,” but which one delivers ad-hoc access for every driver, on every car, at every site.
The honest answer is that all three have a place. But only one of them is a baseline. The other two are complements that quietly assume the baseline already exists.
QR codes: friction moved, not removed
A QR code is the cheapest thing to print. That is its appeal and its tell.
There are two kinds, and the difference matters:
- A static code is a sticker — the same image on every charger of a model, or worse, on every charger in a network. Trivial to deploy, and trivial to abuse: anyone can peel it off and replace it with their own, routing a driver’s first tap to a lookalike payment page.
- A dynamic code is generated per session or per connector and tied to live state. It closes most of that gap, but it needs a screen or a backend to render it — which erodes the “it’s just a sticker” economics that made QR attractive in the first place.
Now follow the driver past the scan. The camera opens a URL, and that URL almost always lands in one of two places: an app install page, or a web payment form. Either way, the driver who came to avoid an app is now typing card details into a phone browser on a cold, possibly rainy forecourt, hoping the page is legitimate.
This is the core issue with QR as an access method. It doesn’t remove the friction; it moves it one tap downstream. The conversion-killing steps — registration, manual card entry, trusting an unfamiliar web page — are all still there. You’ve just relocated them from the charger to the driver’s screen. And the security model is only as strong as the weakest sticker in your fleet.
QR is genuinely good at two things: bootstrapping a site that has no other hardware on the charger, and deep-linking a driver into an account flow they already have. On a lower-power AC charger where the regulator accepts it, a well-built dynamic code is a legitimate primary method. As the front door for a stranger’s first charge on a busy high-power site, it carries a real spoofing surface and a card-not-present cost structure that the hardware-on-the-charger path avoids.
Plug & Charge: elegant, and conditional
Plug & Charge is the most elegant answer on this list. The cable authenticates the car. You pull in, plug in, and the session starts — no screen, no scan, no card, nothing to tap. When it works, it is the best driver experience in the industry.
The catch is everything that has to be true for it to work. The vehicle needs the right onboard support and a provisioned certificate. The driver needs a contract with an eMSP, established ahead of time, that the charging network recognizes. The car and the contract have to be matched through a provisioning chain that spans the automaker, the contract provider, and the network. Rollout is real but partial — plenty of cars on the road today can’t do it, and plenty of drivers have never set up a contract.
So Plug & Charge structurally cannot cover everyone. It covers drivers who own a capable car and have already entered a contract relationship. That’s a meaningful and growing population, and you should support it wherever it exists. But it is, by construction, an account-based method wearing a frictionless coat. It binds the driver to an eMSP contract — which is precisely the thing ad-hoc access was invented to not require.
Think about who actually shows up at a public charger and needs to pay on the spot: the visiting driver in a rental, the borrowed-car owner, the fleet vehicle with no personal contract, the tourist from another country, the budget EV that never shipped a certificate. Plug & Charge waves all of them through only if they happen to be pre-provisioned. Most aren’t.
Plug & Charge is a premium lane. A premium lane is not a substitute for the main road.
The card terminal: the only universal one
Now the unglamorous option. A card terminal at the charge point — present a card, get charged.
Start with the property neither of the others has: universality. A payment card carries no eligibility check upstream of itself. No app, no account, no contract, no certificate, no compatible vehicle, no pre-provisioning. The rental driver, the tourist, the fleet, the older EV with no Plug & Charge support — they all pay the same way. It is the only method that works for essentially any driver on day one, which is the entire point of ad-hoc, and the reason it scales without an onboarding funnel in front of it.
It’s also card-present. An EMV tap at the charger settles with card-present economics, not the card-not-present markups that quietly eat into small sessions — and EV charging is full of small sessions. A modest top-up shouldn’t carry the cost structure of an e-commerce checkout. The web payment form that QR dumps you into does exactly that. The terminal doesn’t.
It’s also exactly the instrument AFIR points to for high-power sites. The regulation wants a payment method any driver can use ad-hoc at a public charger, and on chargers ≥50 kW it names the contactless reader specifically. A terminal is not a workaround there. It’s the compliant default.
And it works on any car — because it knows nothing about the car. The terminal authorizes a person’s payment, not a vehicle’s identity. There’s no onboarding chain to break.
The driver flow is concrete and short. Park, walk to a charger you’ve never seen, key in the amount you want, present your card. That amount is pre-authorized as a hold. You charge. The terminal display tracks progress — and an optional SMS does too, if the driver chooses to leave a number, though nothing about the flow depends on it. When you’re done — unplug, or press stop — the hold is captured down to what you actually used, the unused remainder released, and a legal fiscal receipt arrives by link.
No app was downloaded. No account was created. No contract was signed. That is what universal looks like.
The trap to avoid: don’t weld a POS to a charger
There’s a wrong way to do the right thing, and it’s worth naming because it keeps getting proposed.
The wrong way is to bolt a POS directly onto one charger model — a bespoke, hardwired integration between that specific charger, a specific terminal, and the CSMS behind it. It demos cleanly. It’s also a trap.
A charger is not a cash register and was never designed to be one. The teams who build chargers are excellent at exactly that, which is the point. Chargers speak OCPP to the CSMS. Forcing a terminal into that conversation means custom extensions, off-standard message flows, and tight coupling between three components that should stay independent. You get something that solves exactly one charger model from exactly one vendor — while real CPO fleets run mixed hardware from several makers, across AC and DC, added over years. The bespoke integration fragments the moment the second hardware model arrives. Now you’re maintaining N custom integrations, and you’ve quietly broken the open protocols that let your network interoperate at all.
The right way is a payments layer bridged over OCPI — the open interoperability protocol the industry already uses to roam and report. The terminal, the charger, the CSMS, and the acquirer stay decoupled:
- Swap a terminal vendor without touching the charger.
- Add a charger brand without touching payments.
- Change acquirers without re-integrating anything.
Any charger, any CSMS, any modern terminal — plug and play. This is the posture Optechain builds Bolt around, and it’s why ad-hoc terminal payments are being standardized in the open — through the EV Roaming Foundation community as the OCPI DirectPayment extension — rather than reinvented per vendor.
The conclusion: baseline plus complements
Be fair to each method, because each is genuinely good at something. QR is a cheap bootstrap, a regulator-accepted option on lower-power AC sites, and a clean deep-link into an account a driver already has. Plug & Charge is the best experience on the road for the drivers it can reach. Both deserve support. Neither is universal — and ad-hoc access is a universality requirement.
The card terminal is the universal baseline: essentially any driver, any car, card-present economics, and the instrument AFIR mandates where power and stakes are highest — no app. Build on that, and let QR and Plug & Charge ride on top as complements for the drivers and moments they fit.
Just don’t weld the POS to the charger. Bridge the payments layer over OCPI, and the baseline holds across every charger, every terminal, and every driver you’ll ever serve.