Multi-factor authentication (MFA) is a security method that requires a user to verify their identity using two or more different factors when logging into a system—such as a CPMS, installer portal, payment dashboard, or maintenance platform. MFA reduces the risk of unauthorized access even if a password is stolen.
The three main authentication factors
MFA combines at least two of the following categories:
– Something you know: password, PIN
– Something you have: authenticator app, hardware token, SMS code, security key
– Something you are: biometric verification (fingerprint, face recognition)
Using two factors is often called 2FA, while MFA may include additional steps beyond two.
How MFA works in EV charging operations
In EV charging ecosystems, MFA is commonly used for:
– CPMS admin and operator accounts (tariffs, user data, remote commands)
– Installer and commissioning access (configuration changes, provisioning)
– Customer support tools (refunds, account changes, dispute handling)
– Payment and settlement systems (PSP portals, merchant accounts)
– API management and developer portals used for integrations
A typical flow is:
– User enters username and password
– System requests a second factor (authenticator code, push approval, or security key)
– Access is granted only after both checks succeed
Why MFA matters for charging networks
Charging systems are operationally and financially sensitive. MFA helps protect:
– Remote control functions (start/stop, unlock, reboot, firmware updates)
– Tariff configuration and billing integrity
– Customer personal data and session history
– Roaming and settlement accounts
– Incident response and auditability for security events
MFA is also a practical requirement in many security frameworks and compliance programs, especially where role-based access control (RBAC) and audit logs are used.
Common MFA methods
– Authenticator apps (TOTP codes): reliable and widely recommended
– Push notifications: user approves a login request on a trusted device
– Security keys (FIDO2/WebAuthn): high security and phishing resistance
– SMS codes: better than passwords alone but weaker than app or security keys
– Biometrics: often used to unlock the “something you have” device
Best practices for implementing MFA
– Require MFA for all admin, finance, and support roles in the CPMS
– Use least-privilege permissions alongside MFA (do not rely on MFA alone)
– Prefer authenticator apps or security keys over SMS for higher security
– Provide backup methods (recovery codes, secondary device) to prevent lockouts
– Log authentication events and monitor suspicious login activity
– Enforce MFA during sensitive actions (tariff changes, refunds, API key creation)
Common issues and pitfalls
– Shared accounts make MFA ineffective and reduce accountability
– Poor recovery processes can lock out operators during incidents
– SMS-based MFA can be vulnerable to SIM swap attacks
– Users may approve push prompts accidentally (“prompt fatigue”)
– Inconsistent MFA policies across tools create weak links in the security chain
Related glossary terms
Role-based access control (RBAC)
Monitoring access
API integration
Incident response plan
Data encryption
Cybersecurity audits
Access control
Authentication
Firewall protection
ISO 27001 compliance