Case Study Of The VARS Technology Drive Off Scam

"When you have eliminated all which is impossible, then whatever remains, however improbable, must be the truth." (Arthur Conan Doyle)

•Synopsis•

VARS Technology Ltd is a company registered in England and Wales (company number 12245104) with a listed address of Unit 1 & 2 Calder Court, Amy Johnson Way, Blackpool FY4 2RH. In addition to car park management, they claim to offer the world's most advanced service station forecourt protection. Briefly, their system works via their automatic number plate recognition (ANPR) technology which activates when a vehicle enters a service station forecourt. If a driver pumps fuel and then drives off without paying (a 'drive off event', colloquially known as 'bilking') their ANPR system sends data automatically to VARS Technology. The company then apply to the UK Driver, Vehicle and Licensing Authority (DVLA) for the name and address of the registered keeper of the vehicle and pursue them for the cost of the stolen fuel, to which they add their 'administration charges'.

However, based on numerous and growing media reports, it appears to be the case that when VARS Technology are unable to pursue a guilty party for payment, they appear to contrive fictitious drive off scenarios based on very little evidence or even no evidence at all, and proceed to make allegations of theft against individuals who are clearly not legally liable for the theft of fuel.

This article is a comprehensive case study of one such attempted drive off scam that was so dishonest as to be absurd. There was no tangible, believable evidence whatsoever to support the allegation of theft. Furthermore, the narrative presented here clearly demonstrates that VARS Technology's actions were not due to gross incompetence nor due to failures in their internal processes. The only logical conclusion is that this was a deliberate and calculated attempt to extort money from someone that VARS Technology could not possibly have believed was a guilty party. In addition, although VARS Technology were claiming to be acting under instruction from the forecourt, the forecourt's legal advisor made plain this was not the case. VARS Technology were acting entirely of their own volition.

•Media Reports Of VARS Technology Drive Off Scams•

When VARS Technology observe that a bona fide drive off event has occurred it is legally and morally appropriate for them to approach, on behalf of the forecourt owners, the correctly identified individual, directly responsible for the fuel theft, and to request payment from them. They can apply for judgment through the civil court system if they do not pay. This article is not concerned with such legitimate cases. Rather, it discusses the numerous and growing reports of VARS Technology's approach when they are unable to correctly identify the guilty party, in which they appear to contrive fictitious drive off scenarios in order to chase payments from innocent parties. These fictional scenarios are a disturbingly common feature in internet search results, especially so on legal advice forums, anti-scam websites, motoring websites, company review websites, and several social media. YouTube channels which 'audit' the behaviour of companies have also come to the conclusion that VARS Technology have an unethical side to their business. Especially numerous and growing are reports on Trustpilot. Mainstream journalists are now starting to take notice. For example, on 20 December 2025 the 'Guardian' newspaper published an article authored by journalist Taro Kaneko, in which he outlines two cases of the VARS Technology drive off scam (though he diplomatically refrains from using that term). From all of these sources, the systematic use of three principal kinds of fictional scenario can be identified (bold added):

1. Where the victim's vehicle was present at the location and time of the alleged drive off event, and the driver paid for fuel (the most common variant of the scam):

"They accused me of a drive off. However, I didn't drive off. I had paid on the day via a fuel card which meant I gave the cashier my Car Registration and had proof via the Fuel Card Statement. VARS took so long in responding, that the charge levied had increased."

".......received a letter from VARS Technology claiming I drove out of the .......petrol station without paying.......Checking my statements I see I did get petrol there that day and I have proof I paid for it. The photo they offered as evidence didn't show date/time or even my car at the pump."

"I have been issued a Drive Off Notice by VARS for fuel I bought and have a till receipt for, complete with time, date, reg no. which I sent a copy of.......they just ignore my letters and till receipt and send me an increased bill as I haven't paid in the 'specified time' they are now threatening bailiffs and court action."

"This has happened to my husband also. He was accused of leaving a forecourt not paying £15.28 in fuel. We have a receipt etc that proves he actually bought fuel to the price of £20 and paid it off."

2. Where the victim's vehicle was present at the location and time of the alleged drive off event but the driver did not actually dispense any fuel:

"I went to a local station to get some groceries (Not fuel) a few weeks later I received a letter from VARS Technology saying I didn’t pay for fuel. I asked them for proof, and they sent me a picture of my vehicle leaving the station and demanding payment. I went back to the station and spoke to the manager. They took a look at the CCTV and it turns out my vehicle went nowhere near a fuel pump. No apology from VARS, just threats of legal action."

"Here is one example of how the "scam" works. Your vehicle drives into a petrol station with a food outlet attached, you buy some food, but do not use the fuel pump and drive off. Having captured your registration on ANPR.......a claim is lodged.......for an amount owing by you, as you failed to pay for fuel."

"I was shocked to be told that I had supposedly driven off without paying £7 for petrol. That never happened. In fact, I had been in the shop the night before buying nappies for my baby. After reviewing their records, the staff admitted it was an error on their part. I thought that was the end of it. Months later, I received a letter from Vars Technology demanding £127 for this "unpaid" £7 - something the petrol station had already admitted was their mistake."

"Vars Technology have accused me of driving off without paying for my petrol! This is utterly ridiculous and a SCAM!.......I have now had 2 Debt collectors letters asking for £160 and several calls from them......yes I did drive into the.......petrol forecourt but as it was busy I drove out again, I did not get any petrol at this garage as I was short on time."

3. Where neither the victim, nor the victim's car, was present at the location and time of the alleged theft (possibly the most egregious variant of the scam and the same scenario described in the upcoming case study):

"If there was a picture of me actually in the petrol station or car at said petrol station maybe I'd understand a little but from the picture the car was pulled up on the side of the road somewhere so how that equates to me "stealing" £8.04 is ridiculous."

"This awful outfit sent me a letter saying I owed them money for a payment agreement to a petrol station that I had never heard of, using a car and number plate that wasn't mine in someone else's name! I contacted the DVLA and the car wasn't linked to me at all, contacted the police too, emailed the scam artists VARS and wonderfully they've not even responded yet."

"They sent us a notice for non payment for a vehicle we don't own and never have.......We were nowhere near the motorway on the day in question and do not know anyone by the name that was given."

"They have falsefully accused my husband of buying fuel from a Fuel station at Nuneaton and not pay, sent him a bill of £77.19 and threatened to increase to £137.19 in 14 days. They have pictured a car different from our car…….also showed a photo of a different person."

Unsurprisingly, over 99% of VARS Technology's Trustpilot ratings are 1 star and other review sites agree; VARS Technology have a quite appalling consumer relations profile. Indeed, it is hard to imagine a company with a worse reputation, to the point that in March 2026, The Fraud Codex organisation gave VARS Technology the following fraudulent risk score:

Fraud Codex score for VARS Technology, March 2026. — Fraud risk assessment for VARS Technology from The Fraud Codex organisation.

•VARS Technology's Scam Red Flags •

Financial scammers typically employ well-developed scripts and it has become possible to ascertain to a high degree of accuracy whether someone is being scammed by identifying specific behavioural characteristics of the people they are in contact with. Some notable scammer red flags include:

An initial unsolicited letter, email or text from an unfamiliar source alleging the recipient has done something embarrassing or illicit, of which they have no knowledge yet, in consequence, are claimed to owe the sender a financial debt.
No actual evidence of the alleged debt is ever provided by the scammer.
A clear data mismatch exists between the information provided by the scammer and the information held by the victim and this mismatch is readily apparent to any objective third party.
The scammer presents themselves as having, and acting under, legal authority, often using an exaggerated, pseudo-legal style of language.
The scammer deliberately exaggerates and is otherwise misleading as to the nature and certainty of the potential legal consequences of not complying with their demands.
The scammer sets arbitrary time limits which are noticeably shorter than are usual in legitimate business practice, imminent deadlines to which their victim must comply in order for the scam to cease.
Threats of escalation are made when the victim attempts to question the validity of the scammer's claims or does not comply promptly.
No independent, viable and objective appeals mechanism is offered to the victim.
The ability for the victim to communicate with the scammer is made difficult by design. Often they provide no customer facing phone number. Contact is usually expected to ensue via emails or texts most of which are either ignored or replied to several days later.
The scammer routinely fails to respond directly and appropriately to valid points raised in correspondence, offering little in the way of any proper dialogue, relying heavily and persistently on simplistic, formulaic, repetitive set scripts.
There is an insistence that the victim provide the scammer with personal information, despite having no legal authority to make such demands.
The scammer ignores data protection legislation, even claiming that it doesn't apply to them.
Written communication from the scammer includes grammatical errors, including poorly constructed sentences. They are often ambiguous in meaning, and sometimes even gibberish.
When media reports of their unethical behaviour emerge and they are offered an opportunity to reply, the scammer either ignores this or, if they do reply, they never directly address specific issues, offering only vague, boilerplate replies.

The presence of a few of these red flags are not necessarily evidence of a scam; some businesses are simply very poorly managed or have minimal regard for customer relations. However, when all, or a majority of these red flags are present, it is always reasonable and prudent to infer that the perpetrator is deliberately sailing legally close to the wind, and/or is operating a scam, even when it operates alongside legitimate business activity. Victims of VARS Technology's drive off scams regularly report the majority of these red flags. Indeed, in the case study discussed here, VARS Technology were observed to exhibit behaviours meeting 13 of the 14 red flags.

In the academic research literature the constellation of tactics described above is labelled 'FUD' (fear, uncertainty, doubt). FUD is a form of manipulation designed to provoke victims toward minimising logical trains of thought, thereby provoking impulsive reactions aimed at pressuring people to act against their best interests and, importantly, to disregard their rights enshrined in law. Obviously, these tactics are blunt and unsophisticated and so definitely don't work in all cases. Scams are most effective when victims are vulnerable and so inclined to blindly obey the scammer's demands and some people are too generally astute (or legally aware) to acquiesce. All scams are a numbers game. The scammer doesn't expect to win them all. However, if enough innocent victims prove fearful enough to accede to their monetary demands, often simply to get rid of the situation they have been put in, it makes it worth the scammers time. As is evidenced by these victims of VARS Technology (bold added):

"Despite having a valid receipt for fuel VARS refused to accept the full amount had been paid…….Have paid it because of the distress this has caused by threatening to double costs if not paid within 14 days."

"I am paying just to get them off my back even though I know what they are accusing me of is not true. They say I drove off without paying for petrol when I actually bought groceries. They have provided no proof or CCTV images."

Scams are significantly under-reported crimes. The charity Victim Support, in a written submission (125742; October 2023) to the UK Parliamentary Committee, 'Financial Reporting and Audit', estimate that only 1 in 7 victims in the UK let someone else know they have been scammed. Victims typically do not publicly report being subject to a scam due to the embarrassment and perceived futility they feel after paying the scammer. It is almost certainly the case that quantifying reports from various public media alone yields a serious underestimate.

•VARS Technology's Faux Legal Powers•

VARS Technology's legitimate drive off debt enforcement activity is underpinned, not by criminal law, but by contract law. Formation of a contract cannot be forced. For a contract to be legally enforceable it must be possible for both parties to reject the terms of the contract prior to entering into the contract. The contract must also be undertaken with 'knowing consent'; i.e., both parties must have the cognitive capacity to enter into a contractual agreement voluntarily, and both parties must have acted with a 'good faith'. In the case of bona fide drive off events the driver, before commencing the transfer of fuel, must have had the opportunity to view suitably sized warning notices regarding their imminent duty of payment and the possible consequences for not doing so. These must be clearly visible, either on or located very near to the fuel pump and not, for example, miniscule, or positioned well above eye height or found only inside the forecourt's shop. So, the moment fuel is pumped, the reasonable assumption is that an 'implied contract' between driver and forecourt owner has been agreed and is now in place.

VARS Technology's drive off scams, on the other hand, appear to be underpinned by abusing contract law, i.e., by denying that a contract has been fulfilled (e.g., in those cases where full payment has actually been made) or alleging the existence of a contract where one had not been formed or could not possibly exist, (i.e., wholly fictitious scenarios). It is legally well established that a person who is not party to a contract can neither sue nor be sued (the 'doctrine of privity'). In such cases, therefore, when VARS Technology claim that a scam victim is subject to an 'implied contract' this is wholly contrary to both the doctrine of privity as well as the legislated requirement of 'good faith'. It is a legally fictitious claim if VARS Technology know that the person they are alleging to have stolen fuel could never have entered into such a contract by, for example, attending the forecourt to purchase only food and drink, or even by parking their car alongside a fuel pump, but in fact pumped no fuel (for whatever reason, including not agreeing to the contractual terms displayed) or, most obviously, if VARS Technology possess no evidence that the alleged thief was even present at the forecourt at the location and time of an alleged drive off event. Furthermore, a valid contract always requires an exchange of some kind. VARS Technology's scam victims have every right to be provided with tangible evidence that they had, in actuality, personally received fuel to that value and not be expected to be satisfied with VARS Technology simply demanding payment from them.

The most important (and cost effective) component of VARS Technology's drive off scam is the demand letter they send to their victims. When most successful, victims (such as those quoted above) are fearful enough to pay promptly, and sometimes do so before they even realise they are being scammed. In these demand letters VARS Technology present themselves as an entity with legal powers to which the intended victim of their scam has legal obligations. Although they do not use the term 'fine' (and are legally not allowed to do so) many victims of VARS Technology's drive off scams do perceive, and indeed commonly refer, to the demand letters as notifying them of a 'fine' being levied upon them. VARS Technology do nothing to dispel this myth. Ideally, scam victims would be aware of their legal situation and rights, including that VARS Technology have no legal powers whatsoever, even though they often use mealy-mouthed terms like "legally owed debt" and use other pseudo-legal authoritarian language, as in "you will be liable." This is all legal nonsense. VARS Technology have no legal right to decide liability. Liability is decided if, and only if, their legal arguments and accompanying robust evidence have been deemed honest and sound enough to meet the standards expected in a civil court.

When VARS Technology send demand letters to victims of their drive off scams they are sending what is often referred to as a 'speculative invoice'. These are no more than a demand for payment for a claimed, but invariably wholly unevidenced breach of contract, accompanied by a threat of court proceedings for noncompliance. It is, in effect, a specific variant of the well-known 'fake invoice scam' in which a scammer sends an invoice to someone demanding payment for goods or services that have neither been ordered nor received. It is technically fraud to knowingly issue a legally invalid and/or unenforcable invoice, and speculative invoices are widely recognised as being employed where the claimant has little in the way of an arguable legal case. They are often sent out en masse, their primary purpose being to scare or otherwise manipulate a portion of the people receiving them into paying for something for which they are not legally liable. Importantly, the mere issuing of a speculative invoice can never be considered to constitute acceptance of a contract by the person to whom it is addressed and so, in instances of their drive off scam, VARS Technology's speculative invoices remain legally worthless documents until legitimised by a court judgment.

VARS Technology threaten their noncompliant scam victims with "escalating further." By this they are referring to getting a debt collection company to continue to apply pressure on their behalf. These companies send more demand letters threatening legal ramifications, possibly even paying the victim a home visit, all the while adding their own 'administration fees' to the so-called 'debt'. However, as with VARS Technology, debt collection companies are also 'legal nobodies', being neither police, court officers, nor county or high court-appointed bailiffs. Contrary to what many scam victims may think, they cannot enter any property without permission, they cannot remove items from a property, and they cannot force any payment to be made. The best they can (legally) do is simply request that an alleged 'debtor' settle any alleged 'debt'. Victims of VARS Technology's drive off scams can quite legally ignore them, at least until they attempt to issue court proceedings. Unless a court has made judgment against the scam victim and the 'debt' has not been paid within the allotted time, none of VARS Technology's 'debt' collection representatives is able to act, or legally present themselves as bailiffs, and this is the case even when the word 'bailiff' is in their company's name. And be aware that VARS Technology's debt collection partners do have the word 'bailiff' in their company name. Individuals from Direct Collection Bailiffs Ltd. (DCBL) have quite a reputation in legal circles for painting themselves as bailiffs when acting as mere debt collectors with no legal powers. If they receive no joy, their sister company, DCB Legal, can act under instruction from VARS Technology to commence court proceedings and to represent them (or appoint others to do so) in court. This is done often on the flimsiest of evidence, only for them to discontinue at the last minute when a defendant robustly stands their ground and they are forced to pay the hearing fee. They are even jokingly known as 'Discontinue Legal' in some legal circles. One solicitor, in a written submission (WCC0080; 17th April 2024) to the UK Parliamentary Committee, 'Work of the County Court (Inquiry)' had this to say of them:

"Most of my own cases have involved claims brought by solicitors DCB Legal.......In DCB Legal's case there is overwhelming evidence that the firm has no intention of allowing claims to be decided on their merits by a judge. If they are unable to obtain a default judgment, they will badger the hapless consumer (by telephone and in writing) into paying up. If that fails because the consumer puts up a robust defence, gathers evidence, prepares a detailed witness statement etc, DCB Legal invariably abandons the claim before the hearing, having wasted the time of the Court and the consumer, and having caused the consumer enormous distress........DCB Legal's propensity to discontinue claims rather than expose them to judicial scrutiny is so notorious."

What is not commonly appreciated in non-legal circles is that when companies like DCB Legal do discontinue a court claim it remains possible for the defendant to turn the tables on them and file with the court to reject the discontinuance. This forces them to attend court to explain why they tried to proceed to court as a claimant, knowing beforehand that they had insufficient and/or fabricated evidence to support their claim. Costs can then be awarded to the defendant.

VARS Technology's drive off scam is not based on legitimate legal practice in which the mainstay is acting in good faith and presenting robust evidence and sound logical argument to a court. It is built almost entirely on a threat model. It relies firstly on scaring the most vulnerable victims into paying up early to avoid being taken to court, and secondarily on 'robo-litigation', flooding the court system with copious dubious 'cases' in order to obtain default judgments against victims that might ignore the notice of court action, and so not be present to defend the 'case'. Any dubious 'cases' such as the drive off scams that are devoid of evidence and/or consistently and vigorously defended are invariably closed down before the court sits. VARS Technology cannot afford to let any and all 'cases' proceed to court. If they allowed all noncompliant scam 'cases' to be heard in court it would inevitably open their unethical practices to judicial, political and wider public scrutiny. VARS Technology incur less overheads and so maximise profits by making repetitive demands accompanied by the bluff and bluster of threatened legal action than they could ever hope to do via actual litigation.

•Background To The Case Study •

Consider the photograph below. This was supplied by VARS Technology as 'evidence' of a drive off event. If a mental health professional such as a clinical psychologist or psychiatrist showed this image to a patient and asked them to describe what they see the patient might reasonably report:

"I see a young, tall male in a service station, pumping fuel into a green-blue car whose registration plate is E******."

If, on the other hand, the patient had replied:

"I see a short elderly woman in a service station pumping fuel into a very dark grey or black car whose registration plate is F******"

the clinician would undoubtedly suspect the patient was either playing a joke or suffering from some perceptual and/or cognitive deficit. If, after being repeatedly challenged, the patient persevered with the claim that this image was definitely an elderly woman with a very dark grey car with vehicle registration F****** psychopathology would quite reasonably be inferred.

Poor quality image provided by VARS Technology showing nothing more than a male person fueling his car

For example, viewing an image of a tall young adult male and perceiving him to be a much shorter elderly female would easily qualify as a criterion for diagnosis of a delusional misidentification syndrome per Diagnostic and Statistical Manual of Mental Disorders 5, most likely symptomatic of someone suffering from a psychotic state, caused by e.g., schizophrenia or dementia. Similarly, accurate discrimination of simple line patterns, such as are displayed on vehicle registration marks, are routinely used to measure non-verbal intelligence in children as young as five years old, e.g., in Raven's Progressive Matrices. So, if asked why they were insisting the first digit of the registration mark was an F, the patient had countered with:

"whilst I appreciate that the vehicle is showing the character 'E' I am aware this has been tampered with and has been identified as the vehicle F******"

diagnoses of psychosis and/or cognitive deficit would surely be strengthened. Nevertheless, the above quote is identical to that of a member of staff at VARS Technology in response to a discrepancy in registration marks. The parallels between assertions made by a hypothetical psychologically challenged patient and assertions made by two employees of VARS Technology were glaringly obvious throughout this case study.

This is not entirely surprising. It is common for scammers to make seemingly absurd and illogical claims, and even to persevere with absurdities to the point of obvious irrationality befitting mental health issues. In the early days of the internet, for example, scammers didn't really believe they were Nigerian Princes with money transfer issues and neither did they expect the majority of people they emailed for help to believe it either. Bogus lawyers do not really believe they have identified you as a long-lost relation of the deceased to whom they will forward £1,000,000 on receipt of your bank details and a £1000 bank transfer fee. Neither do scammers believe they are officers of 'His Majesty's Supreme Court of London', in order to have their victims pay imaginary fines by sending them gift cards. Similarly, one would hope that no one at VARS Technology really believes that elderly women living hundreds of miles away deliberately alter their registration plates and disguise themselves as young men in order to steal less than a full tank of fuel. Yet VARS Technology do appear to reliably concoct fictitious scenarios that are just, and even more absurd. The following report is from Facebook:

"I drive an electric vehicle so impossible to take petrol. They claimed it was for £35 and also was now charging an administration fee as well so actually wanted £65. I sent them a copy of the V5 logbook to prove I drive an EV. Clearly they have some issues with this system and its definitely not foolproof."

Not foolproof indeed. Scammers commonly concoct these absurdities in order to quickly filter out the more astute or suspicious victims, leaving them to immediately benefit from the more profitable victims; scared, gullible and/or vulnerable people who are most likely to acquiesce to their demands.

According to VARS Technology (and notably only VARS Technology, this was never verified by anyone else, including anyone at the forecourt or their legal representative), on 11 September 2024 at 16.07 hours the Audi A3 pictured above entered the forecourt at ESSO Braywick service station, located at 11 Windsor Road, Maidenhead, England SL6 1UZ. The service station's parent company is Asda Express Ltd (also referred to as EG). The driver is alleged by VARS Technology (and only VARS Technology) to have dispensed fuel and then driven off without paying. As became known later, the above image was the only piece of 'evidence' VARS Technology ever provided for this alleged drive off event. What they created from that single image probably wasn't delusional, but it was a wholly fictitious scenario with which they threatened and attempted to extort money from a person they could not possibly fail to know was innocent. According to DVLA records, the registration mark E****** corresponds to a red Ford Ka, a completely different make, model, and colour of vehicle than the one depicted. Thus, the vehicle VARS Technology claimed the alleged thief to be driving was, quite obviously, displaying cloned or altered plates, making the sole evidence of illegality demonstrated in this image to be the fraudulent use of a registration mark, per s.44 of the Vehicle Excise and Registration Act 1994.

What follows is a detailed description and analysis of this specific example of an attempted VARS Technology drive off scam. The 'case' played out over two months, October to December 2024, involving a dialogue across 20+ emails involving three different VARS Technology employees, as well as additional correspondence from the legal representative of the service station. It is an evidence led, accurate depiction of events, accompanied by sound deductive inferences based on VARS Technology's own statements and responses. There is no embellishment of facts. Nothing is based on hearsay or secondhand reports. All quotes are verbatim, in context, sometimes truncated for clarity but never 'mined'. The author was actively involved, in the background, with all communications between the scam victim, VARS Technology and the legal representative of the forecourt. All correspondence has been employed here with the express permission of the scam victim and all has been safely archived. In most cases the laws quoted pertain UK-wide, particularly the data protection legislation. Others are directly applicable only to England and Wales. Quotes from VARS Technology's website and documentation pertain to that published at the time of the scam, unless otherwise noted.

•VARS Technology Initiate Their Drive Off Scam•

The author's interest (and first knowledge) in VARS Technology originated when a letter dated 30 October 2024 was sent to someone they know well (hereafter referred to as SV, for 'scam victim'). It referenced the aforementioned alleged drive off event at ESSO Braywick on 11 September 2024. The letter was directly and personally accusatory (bold added):

"You obtained 40.16 litres of fuel worth £58.91 and did not pay for it!"

A demand was made for payment of £88.91, being the cost of the alleged stolen fuel plus VARS Technology's £30 'administration charge' and went on:

"You must pay the above sum within fourteen days of this notice…….If not paid within fourteen (14) days you will owe £118.91."

The first demand letter sent to SV by VARS Technology

A number of features in the demand letter immediately stood out to everyone who was shown it as strongly indicative of a scam.

First, the image provided by VARS Technology depicts a tall male (approx. 1.8m+), likely aged 20s, maybe early 30s, dispensing fuel. SV is female, much shorter (approx 1.55m), and aged in her late 60s, with a traditional female first name. If they had exercised any due diligence, VARS Technology could be under no illusion that this person and SV are not identical. Despite this, the letter makes no indication as to whether the terms "you obtained" and/or "you must pay" refer to the person actually pumping fuel or SV herself, in her capacity as recipient of the letter. Either way, VARS Technology's speculative invoice was obviously legally unenforceable because SV herself is not depicted as stealing fuel, it is not her vehicle depicted in the image and, even so, the registered keeper of a vehicle cannot be liable for theft of fuel by another driver. VARS Technology were surely aware of this.

Second, VARS Technology market themselves as a company developing and utilising high-tech cameras and optics yet this letter included only a low-resolution image containing a high degree of chromatic distortion along with much digital noise. The colour of the vehicle is so unclear it does not seem to feature in any factory available option for Audi cars of that age. There is also noticeable perceptual distortion, especially along the x-axis. When marketing their services to potential forecourt clients it is highly doubtful that a high-tech company like VARS Technology would present themselves with image quality as poor as this. The image provided looks like it was captured on a toy camera with a plastic lens and a fixed focus and aperture. A budget DSLR camera with a consumer grade lens would undoubtedly have produced a far higher resolution and clearer image. Yet nowhere in the letter was it stated that any more robust visual evidence was available. No matter, an enlargement is provided here; despite the ridiculously low-tech image quality, the first letter of the registration mark is unambiguously an 'E'. So this is clearly not the vehicle referred to in the demand letter, of which SV was the registered keeper. VARS Technology should have noticed this.

Close-up of the registration mark from the only piece of evidence available to VARS Technology

SV's vehicle registration mark was F****** (she no longer owns the car) and her front plate had a prominent distinguishing feature to the side, built into it's construction (a flag of one of the constituent countries of the UK). Furthermore, SV's car was a noticeably darker colour than the one in the image, appearing close to black, while the car depicted here appears to have a much lighter blue-green hue. Despite these discrepancies, SV's registration mark F****** was the only one quoted in the letter. The actual, visible registration mark, E******, received no mention. SV immediately reported the drive off allegation and the cloned/altered plate in their image to both Thames Valley police (where ESSO Braywick are located) and her local police force and, on two occasions, she provided VARS Technology with both crime reference numbers issued. VARS Technology did not acknowledge these at all.

Third, despite the pseudo-legal trimmings, the general style of language and grammar used was unsophisticated, i.e., it was a mishmash of imperative and declarative phrases e.g., "you must pay", informal language styles, e.g., "and did not pay for it!" (note the silly social media style exclamation mark!) and they even included at least one grammatically incorrect sentence, widely recognised as a strong characteristic marker of scammers (bold added):

"In the process of recovering the money owed to the forecourt we several costs and the administration fee allows us to recover those costs."

A grammatical error as obvious as this could not be due to incompetence. Is it really plausible that VARS Technology had been issuing numerous copies of this demand letter and not a single person, from within their own ranks or beyond, had pointed out that this sentence is grammatical nonsense? The grammatical quality of a scam text depends on the demographic it is aimed at. Poor standards of communication act as a gullibility test. If aiming to elicit money only from people who are trained to critically examine texts, grammatically correct and formal language throughout would be needed. Poor grammar and mixed textual styles would be more likely to be identified as a scam and dealt with accordingly. Scammers deliberately target less educated, less informed, more vulnerable members of the general public, who are more likely to skim read. Poor grammar and mixed textual styles are reliably shown to be more effective at eliciting FUD. It is far more believable that VARS Technology are doing this deliberately than they are in need of a proofreader. Accordingly, when both the front and back of the demand letter was uploaded to Savi Security's 'ScamWise' tool, which analyses text and behavioural patterns commonly used by scammers, the following was returned:

SCAMWISE SCREENSHOT — Results of a textual and behavioural analysis of VARS Technology's demand letter sent to SV, performed by Savi Security

There was also a highly misleading pseudo-legal statement, e.g., (bold added)

"Failure to pay this may lead to court proceedings being raised against you for which you will also be liable for any additional costs."

VARS Technology clearly want the recipient to assume their letter is legally authoritative yet, to anyone with a knowledge of civil law, this sentence misrepresents their legal position in a particularly dishonest way. The wording is intended to dissuade scam victims from taking advantage of the protections offered by the civil court system by suggesting that, should the 'case' proceed to court, scam victims will be liable for any additional costs, seemingly regardless of the outcome of the case, i.e., even if VARS Technology lose the case. The statement is patently untrue. The default position in civil courts is one of cost neutrality. Each party is responsible for its own costs and any reimbursement of costs is entirely at the discretion of the judge and dependent on the strength of the claimant's case and the attitude and demeanour of both parties involved. There is certainly provision for a defendant to request full costs from a claimant that has lost their case and VARS Technology would be aware of this. From Section 44.16 of the Civil Procedure Rules:

"Orders for costs made against the claimant may be enforced to the full extent of such orders with the permission of the court where the claim is found on the balance of probabilities to be fundamentally dishonest."

When reaching the end of this case study, the reader will surely appreciate that should VARS Technology have been foolish enough to seek judgment in court, they would almost certainly have been found to have acted in a fundamentally dishonest manner.

Fourth, nothing within the single image provided by VARS Technology is even vaguely suggestive that the person depicted was stealing or even intended to steal fuel. For an allegation of theft to hold any legal weight, either in a 'no reasonable doubt' criminal court or on the 'balance of probability' test used in a civil court, more evidence than this would be expected, ideally in the form of either a series of time-stamped still images, and/or coherent CCTV footage, demonstrating the driver's intention to steal, i.e., including both the event of obtaining the fuel and the subsequent drive off event following no attempt to make payment. This image alone would be laughably inadequate as evidence in any court of law. Further, on the demand letters issued by VARS Technology for parking infringements they clearly state "these images are photographic evidence of the incident." Regardless of the truth of that statement on any specific occasion, it is interesting to note that no similar statement was included in this demand letter. It must have been obvious to everyone at VARS Technology that this image was not only technically defective, but legally defective too.

Fifth, unlike their parking demand letters, which quote legislation that the registered keeper may be liable for the actions of a driver (albeit in specific circumscribed conditions) at no point in this demand letter did VARS Technology quote any legislation for claiming that the registered keeper of a vehicle can be deemed liable for theft of fuel by an unknown driver. This was not a mistake by VARS Technology; they would be aware no such legislation exists.

On receipt of the demand letter, SV immediately replied to VARS Technology via email:

"I deny your claim that either myself or my car was involved in a theft of fuel. On 11/9/24 my car was several hundred miles away from that location and indeed has never been in that area since being in my ownership."

This was an understatement. On the date of the alleged theft SV's car was not only provably hundreds of miles away from ESSO Braywick, but her car was also not even in England. Indeed, in the nine years SV had owned the car, she cannot recall a single time it had ever been driven anywhere in England. She went on:

".......in the photograph you have provided, the first letter in the registration number is clearly an E and not an F as you claim. See two attached photographs, the first being the one provided by you and where the E is clearly visible, and the second an enlargement of that number plate.......This is sufficient evidence to demonstrate that you have identified the wrong vehicle.......I look forward to confirmation that the matter regarding myself is settled and I formally request that you delete any personally identifiable information about me."

This should have laid the matter to rest. Any honest person or company would have realised the error or, at the very least, the obvious futility in taking this 'case' to any legally sanctioned conclusion, and immediately shut the scam down. Incredibly, however, VARS Technology's reply (discussed in more detail later) actually expressed doubt that the registration marks were in fact different, outright ignored both the crime reference numbers provided as well as the perfectly legitimate request for deletion of her personal data. The situation was both menacing and absurd; Kafkaesque and Pythonesque. Consider these two scenarios:

A photograph of SV pumping fuel into a vehicle of which she was the registered keeper is sound evidence that SV is legally liable for the cost of the fuel.
A photograph of an unknown male pumping fuel into a vehicle whose registered keeper is unknown is sound evidence that SV is legally liable for the cost of the fuel.

VARS Technology would surely have issued SV with a demand letter in the first circumstance, and they had issued her with a demand letter in the second circumstance. They would consider these two circumstances to be legally equivalent. Such an absurdity is well within scammer territory. One wonders what criteria VARS Technology actually use to differentiate between sound evidence and unsound evidence, whether to pursue a 'case' or not? Assuming an absence of psychopathology, and that no company could be this incompetent, it was hypothesised that VARS Technology likely had, in good faith, looked up the make and model of vehicle E****** in order to pursue payment and, finding another vehicle entirely, realised they had little hope of pursuing the driver for payment. However, not to be defeated, they had further searched through the publicly available DVLA records just in case a similar model of vehicle with a similar registration mark showed up. Finding vehicle F****** to be a close enough match, they initiated their scam by sending SV a demand letter in the hope she could be scared into paying. As will be shown, this hypothesis received considerable support.

Of course, SV could have simply ignored the demand letter. This scam was going nowhere. No half-competent solicitor would present such a frivolous and/or vexatious 'case' to a judge based on this quality of evidence. Nevertheless, SV was incensed that VARS Technology had the temerity to formally make the allegation that she was a thief and liable to pay for someone else's fuel. So she was curious as to how long they would act out their scam theatre before inevitably giving in. Thus, the ensuing communication she had with them included a strong element of scambaiting. Surprisingly, VARS Technology seemed to concentrate so much on keeping to their scam script that they never seemed to comprehend they were being scambaited and they actually tried several strategies to extract compliance before eventually conceding defeat. Even then, their stated reason for conceding defeat was also patently untruthful.

•VARS Technology's Deceptive Application to DVLA•

Personal data refers to any information that can be used to identify a natural person. Under UK GDPR 2018 an image of a vehicle registration mark is not considered personal information per se but does become so when used, or is intended to be used, to identify a living person. A Data Subject Access Request (SAR) quickly submitted by SV to the DVLA revealed that VARS Technology had speedily applied for the personal details of the keeper of vehicle registration F****** on the very next day following the alleged theft of fuel, i.e., on 12 September 2024. VARS Technology can legally make these inquiries based on their own contract with the DVLA, which is governed by the legal framework 'Keeper of a Vehicle at the Date of an Event' (the 'KADOE Service'). However, they cannot do so on a whim, nor as a 'fishing' expedition in order to concoct a 'case'; they must have a legitimate reason for doing so. By inquiring about the personal information of the keeper of the vehicle with the registration mark F******, VARS Technology were clearly in breach of of UK GDPR 2018 as well as Schedule B7.2 of KADOE, which states (bold added):

"The Customer [i.e., VARS Technology] shall ensure before relying on any item of Data that the Data provided matches the information in the request…….and shall not seek to recover payment where the Data provided does not match the vehicle information in the request."

It is a simple fact that the vehicle registration mark in the image VARS Technology offered as 'evidence' did not match the vehicle registration mark quoted by VARS Technology to DVLA in their request for the identity of a registered keeper. In addition to contravening UK GDPR 2018 and the KADOE contract, the unlawful access to SV's data is potentially also a criminal offence under s.170 of the Data Protection Act 2018. Despite this, VARS Technology's written 'reasonable cause', submitted to the DVLA was worded as follows:

"We are requesting the address of the registered keeper at the time of the event in order to reclaim lost monies for fuel dispensed and not paid for."

Excerpt from VARS Technology's deceptive application to the DVLA to acquire SV's personal data

Initially, it appeared feasible that an employee at ESSO Braywick had, in good faith, misread the vehicle registration plate, either directly or on screen, or had read it correctly yet accidentally keyed in an 'F' instead of an 'E' when sending data to VARS Technology. Hanlon's Razor, i.e., 'never attribute to malice that which can be adequately explained by stupidity' being the relevant rule of thumb here. VARS Technology lent support to this possibility when they informed SV (bold added):

"the forecourt.......passed relevant data to us for us to pursue the unpaid fuel."

In other words, VARS Technology were claiming to be acting solely as an agent, under instruction of the forecourt. However, this was directly contradicted by ESSO Braywick's solicitor when they informed SV that no one at ESSO Braywick had played any part in either the collection or the reporting of the pictured vehicle's registration mark (bold added):

"Each site uses automatic number plate recognition software to identify registration plates that enter our forecourts. This technology is owned by VARS and they manage any offences that occur in relation to a vehicle automatically.......We, therefore do not receive the information.......and there is no communication.......in relation to this incident with VARS."

Deliberately misrepresenting or refusing to disclose the proprietary nature of surveillance equipment runs counter to Art.6 of UK GDPR 2018. Yet, a number of other victims of VARS Technology's drive off scams have also been informed by various forecourt personnel that it was not the forecourt who had given VARS Technology data, as claimed, but VARS Technology's own equipment that transmits data from the forecourt directly to VARS Technology. It came as no surprise that ESSO Braywick’s solicitor sought to distance the forecourt from VARS Technology’s actions. As owner of the forecourt on which VARS Technology collect their data, ESSO Braywick (via their parent company) could very likely be considered jointly and severally liable with regard to any legal repercussions should VARS Technology be deemed to have acted either illegally or unlawfully. This stance of dissociation from VARS Technology's actions was held consistently throughout the forecourt solicitor's communication with SV. In contrast, VARS Technology continually insisted that they were acting under instruction from the forecourt.

In any case, if it took a mere minute for SV to accurately resolve the first digit on the pictured vehicle's registration plate using a low-tech magnifying glass hovering above the demand letter, how come VARS Technology's so-called high-tech ANPR technology misread the plate? According to the local police officer SV spoke with, such misreads are very common and the 'Guardian' article mentioned above quotes an ex-employee of VARS Technology admitting:

"........the ANPR software is "terrible" and has been known to the company as an issue since 2023."

Nevertheless, regardless of the effectiveness or not of VARS Technology's ANPR technology, Art.22(1) of UK GDPR 2018 states that decisions made solely by automatic or 'machine' algorithms are prohibited if they might produce legal effects and, according to VARS Technology's own data use policy at the time, "demand actions initiated by a misread" should not occur (bold added):

"You have the right not to be subject to a decision based solely on automated processing which will significantly affect you. We do not use automated decision-making."

In other words, at least one human being at VARS Technology should have (with, one would reasonably expect, normal or corrected to normal visual acuity) examined the registration plate visible in the image they had provided and have surely concluded (as would any reasonable person), that it was unambiguously and incontrovertibly E****** and not F******. Further, neither incompetence nor accident can exonerate VARS Technology. UK GDPR 2018 also concerns itself with the unintentional collection of personal data. Even if VARS Technology had been genuinely mistaken and an accidental misreading of the vehicle registration mark had been made (by either machine or human), an unlawful breach of SV's personal data would have still been the case. The Information Commissioner's Office (ICO) guidelines define a personal data breach as follows (bold added):

"A personal data breach means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data."

Assuming a genuine misread was made then, upon realising the deceptive nature of their KADOE application (at the very least when pointed out by SV in her initial response to their demand letter), VARS Technology had an obligation to report this breach to the ICO within 72 hours. They did not do so, a clear act of nonfeasance, i.e., failure to act where action is required by statute law. Because the unauthorised access to personal data could have caused the data subject a financial loss they were also required to notify SV that the data breach had occurred. Ironically, they did this. The data breach was in plain sight on their demand letter.

However, a further important detail provided by the DVLA strongly suggests that the data breach was not due to an honest mistake. One would reasonably expect a company director to exercise due diligence even when an employee may not. Nevertheless, the DVLA request for the keeper details of F****** was signed, not by some incompetent or rogue employee, but by a VARS Technology company director. Unfortunately, DVLA redacted his name:

Excerpt from VARS Technology's deceptive application to the DVLA, signed by a company director

Note the wording in the declaration the company director had signed (bold added):

"I declare that the information given is correct to the best of my knowledge.......I am aware that it is an offence to unlawfully obtain personal data contrary to data protection legislation."

If the VARS Technology director had not viewed the image before applying to the DVLA for SV's personal data they would not have been signing the application in good faith. Conversely, if they claimed to have viewed the image before making the application they would be leaving themselves open to being called as a witness in any court proceedings. If they then continued to insist the registration mark in the image was F****** they would be risk of committing perjury. In addition to breaching both KADOE and data protection legislation, this company director's actions would arguably also come under the purview of s.2 of the Fraud Act 2006 which states:

"Fraud by false representation: A person is in breach of this section if he (a) dishonestly makes a false representation, and (b) intends, by making the false representation (i) to make a gain for himself or another, or (ii) to cause loss to another or to expose another to a risk of loss."

It is the intent to make a gain or cause a loss that determines an offence of fraud. Even when gain or loss is not actual, the crime is complete. The evidence strongly suggests, then, that VARS Technology, or their director as an agent of the company, knowingly and intentionally made a false or dishonest representation to the DVLA with the aim of making a financial gain. The current definitive legal test for dishonesty is the Ivey Test (see Ivey vs. Genting Casinos, 2017) and the Supreme Court have ruled that this test can apply equally to both criminal and civil proceedings. There are two factors to consider in applying the test:

What was the actual state of knowledge or belief as to the facts?; and
Was the conduct dishonest by the standards of ordinary decent people?

It would be very difficult indeed for this VARS Technology director to argue that he actually believed he was supplying correct information to the DVLA and it is surely beyond doubt that any reasonable or 'ordinary decent person', when informed of the details outlined here, would countenance his action. The Ivey Test for dishonesty has surely been met. Proceedings for contempt of court may be brought against anyone who makes, or causes to be made, a false statement in a document verified by a statement of truth without an honest belief in its truth. Further, VARS Technology were also highly vulnerable to the affirmative defence, 'Doctrine of Unclean Hands'. The doctrine bars legal relief to any claimant who has engaged in inequitable behaviour directly related to the substance of their litigation. Examples of inequitable behaviour would be fraud, deceit, or acting in bad faith, all of which appear to be more than adequately referenced here.

•VARS Technology Attempt To Shift The Burden Of Proof•

VARS Technology had now been given an opportunity to acknowledge their 'error', report the matter to the ICO per legislation, contact (and apologise) to SV, and allow everyone to move on. Instead, despite its obvious absurdity and legal fragility, VARS Technology chose to persevere with their scam. Because the deceptive DVLA request was made by a company director, it seemed reasonable to assume that the decision to persevere with their 'case', despite SV pointing out the absurdity, had similarly been made by someone in a senior position in the company. Thus, the existence of this website is entirely due, not to any mental health issues of someone at VARS Technology, nor to company-wide incompetence, but to their conscious choice to continue acting in a wholly dishonourable manner.

When VARS Technology make an allegation that someone has stolen fuel from a service station forecourt then the onus is solely and squarely on VARS Technology to present tangible, believable evidence to that effect. They are obligated to do so in their own time and at their own expense. However, in their first response email to SV, VARS Technology pretended as if this was not the case:

"Thank you for contacting VARS Technology. As you have stated the number plate is different, please provide us with a clear image of your vehicle. We need this to be able to close the claim. Once you have provided this we will notify you of the outcome of the claim."

The irony of VARS Technology expecting SV to provide a clear image of her vehicle, after themselves providing such a poor quality image of a different vehicle, was not lost. Having unlawfully acquired SV's personal data from DVLA, VARS Technology were now expecting SV to voluntarily provide them with further personal data. This was never going to happen. There is a well-recognised legal freedom from a requirement to provide personal information unless this is voluntarily done by informed consent or due to a specific legal duty underpinned by statute law. VARS Technology had never requested informed consent from SV and they certainly could not rely on statute law. In any case, what possible purpose did VARS Technology have in mind by demanding an image of SV's registration plate, other than the vacuous "we need this to be able to close the claim"? They already knew (for certain) that it was not SV herself who had stolen fuel. They already knew (for certain) that the car in the image had an altered or cloned plate and SV informed them on two occasions that she had reported this to two police forces, having provided VARS Technology with the two crime reference numbers. As SV replied:

"You have breached data protection legislation by requesting from DVLA details of the keeper using a car registration number unconnected to your 'case'. I find it incomprehensible that you request further personally identifying information from me in the form of a "clear image of your vehicle".…….let me make it perfectly clear that my refusal to provide you with an image of my registration plate or any images of my car in no way implies guilt. Firstly, I reasonably take offence at your attempt to extort money by menace. Secondly, you have no legal authority to demand images of my car. I am however happy to provide any necessary images to duly authorised officers representing the Police or a Court. You are neither. Thirdly, given VARS' arrogant and cavalier approach to data protection protocols I am reluctant to provide any further personally identifying information due to the risk that you would misuse or tamper with it."

What VARS Technology were attempting to do was to intimidate SV by disingenuously shifting the legal burden of proof from themselves. Such a stance is based entirely on an 'argumentum ad ignorantiam', or 'argument from ignorance'. This is a logical and legal fallacy describing the circumstance when an assertion or allegation is treated by the claimant as being true, not because they have evidence in support, but rather because of a perceived lack of evidence to the contrary. It is never the job of a defendant to disprove an unevidenced and/or unproven claim. Especially one as clearly absurd as this. In cases of alleged debt the evidential burden of proof always falls entirely on the party making the claim. This is what is known as 'trite law', i.e., well-established, widely-recognised, and considered to be elementary. Furthermore, in civil law the party making a claim must be able to demonstrate, on the balance of probability, all of the essential facts they present to the court. In this 'case', this would include tangible evidence that a theft had actually occurred, the value of the goods obtained, and the accurate identification of both the driver and the car. VARS Technology would undoubtedly be aware of this. Yet, in a further email, they again tried to shift the burden of proof, this time with an added threat (bold added):

"As you made the suggestion the image in the drive off claim is not your vehicle we need you to evidence this in order for us to process your claim and come to a decision. Failure to provide such evidence may result in the claim escalating further."

Notice how, in addition to their 'argument from ignorance' VARS Technology try to deflect from the plain and obvious fact that the registration plates are different, viz., "as you made the suggestion"? And their authoritarian pseudo-legal tone, "we need you to evidence this….." SV was not in the slightest intimidated by any threat of 'escalation'. VARS Technology's failings in evidence were not simply 'de minimus' errors (i.e., errors that would bear little consequence to the general nature of the claim). Rather, they were of a Pythonesque 'elephant in the room' kind. Her reply (bold added):

"I wasn't merely suggesting the image in the drive off claim wasn't my vehicle; I was categorically denying it…….Indeed, it is yourselves that have presented clear evidence that it is NOT my vehicle filling up at the petrol station…….If you doubt this, it is solely YOUR responsibility to produce evidence to the contrary."

At no point did VARS Technology ever attempt to explain why they thought their burden of proof should be reversed. They must have been aware that their expectations were based on fallacy.

•VARS Technology's Pretence Of Keeper Liability•

An example of VARS Technology's forecourt notices in which they pretend to be operating under the authority of the Theft Act 1978

Example of VARS Technology forecourt notices in which they pretend to be operating under the authority of the Theft Act 1978

A contract can be formed either (i) verbally, (ii) in writing or (iii) by behaviour (in the present 'case', for example, by dispensing fuel). Thus in the image provided by VARS Technology in their demand letter, a contract does appear to have been formed by the male person accepting the terms in the contractual notice used by VARS Technology at the time, and then dispensing fuel. Note, however, that the signage VARS Technology used at the time primarily references the Theft Act 1978. This is obviously an attempt to convince drivers that VARS Technology are somehow acting under the lawful authority of that particular legislation. They are not. The Theft Act 1978 is concerned solely with criminality, not contract law. It is a matter for the police. This reference is hypocrisy on their part. If VARS Technology were to advance their drive off cases solely down the criminal law route it would adversely affect their business model. This is because, despite what VARS Technology state on their signage, driving off without paying for fuel is not always a criminal offence. For the crime of fuel theft to be realised, a defendant must have possessed mens rea, i.e., they must have had cognitive capacity occasioning a knowing intention to steal fuel. Put simply, one cannot steal, in the legal sense, by mistake or accident. Thus, if VARS Technology relied on the Theft Act 1978 in good faith, they would be unable to pursue cases involving e.g., genuine absent-mindedness or otherwise confused individuals and/or 'failure to charge' scenarios, i.e., human and technological failings at the forecourt's till. Interestingly, VARS Technology previously quoted s.3 of the Theft Act 1978 on their demand letters sent following an alleged drive off event. They no longer do so and it is not hard to see why. Dropping this wording gives VARS Technology some excuse to pursue otherwise legally dubious 'cases' under contract law, and also to hide the fact that, for many of their victims, allegations of theft made by VARS Technology would not be considered in a criminal court.

Even if we were to grant that a bona fide drive off event did occur in the present 'case', any legally valid contractual relationship regarding theft of fuel could only have been formed between ESSO Braywick and the actual, depicted driver of the vehicle. This fact seriously constrains VARS Technology's ability to pursue civil legal action in many of their scams and other legally dubious cases. SV was in no position to fulfill any of the three criteria for contract formation listed above because she, according to the very evidence presented by VARS Technology, could not be demonstrated to be present at that time and location. Accordingly, she not only clearly did not dispense fuel, but she was also not the registered keeper of the vehicle involved. It would be absurd to claim otherwise.

The question of whether or not a debt has arisen is ultimately assessed in a civil court on the basis of probability. But the identity of a debtor cannot be decided on the basis of probability. In civil legal proceedings, the party making the claim are held to strict proof that the person they allege to have caused a loss, and so is liable for the debt, has been correctly identified and is not simply a 'probable' or 'likely' candidate. This has been a cornerstone of civil law for well over a century (see e.g., Dunlop Pneumatic Tyre Co. vs. New Garage & Motor Co. Ltd, 1915). Even older, but still very current law, neither a person's disinterest, lack of communication, nor 'silence' regarding an allegation of contractual debt can be used as evidence that a contract had been formed (per Felthouse vs. Bindley, 1862). Furthermore, in the absence of an accurate identification of the driver, the registered keeper of a vehicle allegedly involved in fuel theft cannot be presumed or inferred to be identical to the actual thief. So, even if the vehicle pictured had been SV's car with someone else driving, neither an allegation of criminal theft nor breach of contract could have automatically extended to her, as the registered keeper of the vehicle. Even when it is unclear but possible that the registered keeper is the driver, liability does not necessarily extend, as a recent ruling in county court (VCS v. Edward, 2023) affirms:

"It is consistent with the appropriate probability analysis whereby simply because somebody is a registered keeper, it does not mean on balance of probability they were driving on this occasion, because one simply cannot tell…...it is not appropriate to draw an inference to that, on balance of probability, the registered keeper was driving on any given occasion."

Taken in isolation, decisions made in county court are not legally binding. But they can certainly be referenced in subsequent county court proceedings and taken into consideration by the court, and often are. Nevertheless, the point remains that there is no general legal principle for vicarious keeper liability; only cases specifically prescribed by statute obtain, and these are very few. If VARS Technology thought they had an automatic or even a qualified legal right to transfer liability from an unknown young male driver to an elderly female registered keeper of a vehicle they are alleging was involved a drive off event they should have quoted the legal basis for this in their demand letter. They did not, because no such legal right exists. What's more, even if this had been SV's car in the image they provided, VARS Technology would also have no legal authority to require that SV identify the person dispensing fuel. The obligation under s.172 of the Road Traffic Act 1988, which requires a registered keeper to disclose the identity of a driver at a particular time an offence had occurred is available only to a police investigation (under specific conditions). Nevertheless, in their demand letter sent to SV, VARS Technology do appear to assume that the driver of a vehicle will be known to the registered keeper:

"If you were not the driver at the time of the event, please contact our enquiries team with the name and serviceable address of the driver."

This is a reasonable request in the event of a bona fide drive off event. However, it appears to be the case that when conducting a drive off scam, even when informed of the driver's identity, there is no guarantee that VARS Technology will bother to act on the information they receive. On the contrary, they appear to routinely misrepresent the legal situation to victims of their drive off scams. This example is from Trustpilot:

"…….he explained he wasn't the driver…….He has disclosed who the driver is and yet they still say he needs to pay as he was the registered keeper but he does not own or drive the van…….it's unfair because he didn't steal the fuel, he didn't decide to fill the van up and then drive away without paying for it!"

In the present 'case' for VARS Technology's legal representatives to issue court proceedings based on their image they would be required to accurately identify the male person depicted. They would also have needed to locate his current or last known physical address to which court documents could be correctly served. VARS Technology would not only be aware of this but also be aware that this was very likely an insurmountable barrier. Hence, they initiated a drive off scam, to attempt to recoup money from an innocent party. On two occasions SV broached the impossibility of her liability, on the basis that VARS Technology were thoroughly unable to demonstrate that any contract had been established between herself and ESSO Braywick/VARS Technology, e.g., (bold added):

"You have failed to demonstrate that a contract has been established between the keeper of the vehicle registered F****** and the forecourt owners or VARS Technology. In the absence of an established contract there can be no breach of contract by conduct and therefore no legal basis to collect personally identifiable data either through myself or a third party. It would appear that you are inferring that a contract has been established solely and merely on the basis of some similarity between number plates!"

At no point in their communications did VARS Technology make any attempt whatsoever to offer evidence that a contract had been established. They just assumed it all along, again standing on their 'argument from ignorance'. It seems reasonable, therefore, to presume that they were always aware that no such contract had been formed.

•VARS Technology Fabricate Another False Allegation•

With VARS Technology's drive off scam clearly going nowhere fast, they now tried a different approach. This involved a further false allegation, albeit one that forced them to openly acknowledge the discrepancy in registration plates (bold added):

"Due to the nature of our business we do come across tampered/cloned plates on a regular basis. On this occasion, whilst we appreciate that the vehicle is showing the character 'E' we are aware this has been tampered with and has been identified as the vehicle F******. In this circumstance, as a process we follow, we do request that the motorist provide us with images of their vehicle which we are able to compare with the evidence we hold. Should differences be spotted between yours and the offending vehicle, the claim would close with immediate effect and we would make you aware of this."

This wholly mendacious statement immediately raised several questions. That the registration mark E****** was bogus was known to both SV and VARS Technology from the start. So why did VARS Technology wait several weeks to make a second false allegation that SV had "tampered with" her registration plate? Why not simply openly acknowledge the discrepancy and make the tampering allegation at the very beginning of their contact with her, in tandem with their allegation of fuel theft? Was this really the next logical step in "the process we follow"? Did no one at VARS Technology ever consider that asking a guilty party for an image of their registration plate after telling them they are "aware" it was altered was effectively alerting that person to the need to change it back and then provide an image of the original plate? Obviously, the brightest sparks at VARS Technology hadn't given this strategy enough thought. In the more rational world, the truth was that VARS Technology had never sighted SV's registration plate, so where could this apparently newly-found knowledge have possibly come from? At best this new allegation was a delusional belief. At worst it was an outright lie, an ill-thought out ad hoc response to a noncompliant victim of their scam. And what about the difference in colour between the cars? Was their next step in "the process we follow" to be an allegation that "we are aware" that SV had resprayed? So SV simply asked the obvious question:

"Please clarify your statement…….At what point was the vehicle identified as F****** and by whom?"

Having no meaningful answer, and acting true to form, VARS Technology simply ignored these questions. This suggests that their second allegation was no more than a tedious continuation of their bluff and bluster. If VARS Technology chose to proceed with court action they would be obligated to provide SV with pre-action documents. These would be expected to include the evidence they claimed to hold that she had doctored her vehicle registration mark. But by this time it was pointless for VARS Technology to continue pretending that this 'case' was going anywhere near a courtroom. It would not have even made it to pre-court mediation, being struck out as an abuse of the court's time. Nevertheless, VARS Technology decided to plough on with the scam and what they did next was disgraceful. Despite their 'case' being in active dispute, they sent a second 'Final Notice' demand letter, raising the so-called 'debt' to £118.91. Quite comically, they included the very same image as before. Just as comically, the text in the letter included the same misrepresentation as to liability from court proceedings and again contained an obligatory silly grammatical mistake of the kind seemingly prized by scammers:

".......you have a further 14 days remaining to pay the total amount, including a fee of £60",

followed by the following sentence in the next paragraph:

".......this figure includes the fuel value and a nominal £30 fee."

Art.5(1)(d) of UK GDPR 2018 compels a company to ensure that the data they hold is accurate and, when informed of this inaccuracy, to take steps to ensure that it is made accurate. VARS Technology were well aware of the discrepancy between registration marks. So, the fact that a second demand letter was sent which included the original image is evidence that VARS Technology were refusing to comply with data protection legislation.

The second demand letter sent to SV by VARS Technology

The second demand letter seemed little more than a way of prolonging the scam in order to wear out the victim into yielding to pressure. Yet it must have been obvious to VARS Technology that their scam was floundering. From SV's perspective every aspect of the scam was now being viewed as farcical, even amateurish, as alluded to in her reply (bold in original):

"You have now made a further direct accusation (that I have tampered with my registration plate) that does not logically follow from any of the personally identifiable information you hold about me.…….By doing this you are merely conjuring up a fanciful scenario in order to plug your serious evidential gap. I would therefore like you to clarify what exactly you mean by "we are aware."

SV didn't expect a cogent reply and she didn't get one. In response, VARS Technology declined to address their complete lack of evidence and continued to absurdly assert that, despite the discrepancy in registration marks and colour, the cars were identical and that SV had tampered with her registration plate:

"Your dispute is that the vehicle in the image does not belong to you and you were not the party that has been involved with the tampering of the registration plate......."

With their drive off scam descending into mirth, VARS Technology were forced to change strategy once again, this time employing an obviously insincere conciliatory approach to get her to comply (bold added):

"Throughout our correspondence with you we have tried to resolve the matter before any potential escalation takes place and to do this we do require your cooperation. While you are reluctant to provide any of the requested information to us [i.e., the image of SV's registration plate], we can confirm that if you would like to work with us to resolve the matter, you are permitted to formally request that once the necessary review has been actioned the information you send to us is deleted……"

"You are permitted to formally request" got a laugh too. Who do VARS Technology think they are? Do they think that statutory rights only apply to their scam victims when they do their bidding? SV was always permitted to request that her personal data be deleted, she didn't need VARS Technology's permission to do so, she had a solid legal basis for them to do so, and she had already requested that they do so. They ignored her. Nevertheless, not unexpectedly, their allegation that "we are aware" that SV had altered her registration plate did quietly disappear and was never again mentioned.

•VARS Technology's Arrogant Attitude To Data Protection Legislation•

Just as annoying as the false allegations of fuel theft and altering her registration plate were the recalcitrant efforts made by VARS Technology to hide the details of their deceptive acquisition, from DVLA, of SV's personal data. Recall that nothing whatsoever that might have pointed to SV was included on either the CCTV or ANPR imagery at the ESSO Braywick forecourt. Neither her vehicle, nor her registration mark, nor her physical image had ever been captured, not at this alleged drive off event, nor at any other time. She had never in her entire life attended that location. Recall also that ESSO Braywick's solicitor had informed SV that, with regard to herself, VARS Technology were not acting under explicit instruction from ESSO Braywick:

".......we do not instruct VARS for each individual matter.......and so there is no communication [from Esso Braywick to VARS Technology] in relation to this incident."

It logically follows, then, that the totality of SV's personal data held by VARS Technology had emanated solely from their deceptive KADOE request to the DVLA. The KADOE application was pivotal to the scam; without it VARS Technology would never have made their fictitious allegation of fuel theft against SV. At no point in her communications with VARS Technology, however, did SV ever directly disclose that she had already obtained a copy of their fraudulent application to DVLA. This was purposeful.

In her first email in response to VARS Technology's initial demand letter SV had pointed out what should have been obvious to any honest person; that their so-called 'evidence' portrayed neither herself nor her vehicle and therefore there was no case to be made against her. SV quite correctly wrote (bold added):

"This is sufficient evidence that you have identified the wrong vehicle…….I look forward to confirmation that the matter regarding myself is settled and I formally request that you delete any personally identifiable information about me."

As previously mentioned, VARS Technology ignored this deletion request. In follow up, SV placed weight on VARS Technology's legal obligations:

"I note that you did not address my request to delete any and all of my personal data from your records. The personally identifiable data that you currently hold about me can no longer legally be used for the purpose for which it was purportedly collected. I therefore again request that you do so and that you confirm this in writing."

It was at this stage that VARS Technology made their first duplicitous attempt to divert attention away from themselves and culpability toward the forecourt:

"We are not the data controller. The images come from the site for the purpose of the claim. The data controller in this instance is the forecourt not ourselves."

By referring only to "the images" (which they were aware in no way alluded to SV) and pointedly ignoring the collection of SV's personal data from their own deceptive KADOE request, VARS Technology's obfuscation was all too obvious. Under the circumstances obtaining in this 'case', it seemed highly unlikely that VARS Technology were acting solely as a data processor for SV's personal information. When an anonymised, hypothetical opinion was sought from the ICO regarding this matter they replied:

"In this case they [VARS Technology] would be a joint controller and processor."

However, when this opinion from the regulatory body for data protection law was put to VARS Technology they disputed it. For example, from two further emails (bold added):

"We must advise you we are the Data Processor and not the Data Controller"

and:

"Due to the contracts in place with our client, we can confirm we are not the joint data controller........we must reiterate that it is not our responsibility to directly respond."

These responses were curt misrepresentations of their position and obligations under data protection law. The definition of data controller is rather more coarse grained than VARS Technology were claiming. Because VARS Technology receive ANPR images from "the site" and because they have "contracts in place" does not automatically make them only data processors. Despite what VARS Technology tried to convey, UK GDPR 2018 (and the ICO's own guidance) do not allow organisations to self-define their data role. The definitions of data controller and data processor are predicated solely on how businesses are currently dealing with or have historically dealt with specific data. Although operations are expected to be underpinned contractually, data controllers' and processors' labels and obligations cannot be shaped solely via contract, and neither supervisory bodies or the courts are bound to accept contractual or private arrangements made between companies. According to the ICO you are deemed to be a data controller for several reasons, which include:

you are the organisation which had collected the data in the first place;
you are responsible for the lawful basis by which you acquired the data;

The ICO also reminds us of the scenario in the present case study:

".......if you are a processor, you should remember that as soon as you process personal data outside your controller’s instructions, you will be acting as a controller in your own right for that element of your processing."

In other words, if you solely initiate (i.e., not act under specific documented instruction) the collection of someone's personal data, either purposefully or accidentally, then you become a data controller, even though you may not care to label yourself as such. Thus the moment VARS Technology received SV's personal data from the DVLA they became a data controller for that data (and the same for any other of SV's personal data they may have collected from other sources). Similarly, the KADOE application, signed by a VARS Technology company director, stated clearly that it made VARS Technology responsible in law for acquiring that data. VARS Technology's stance on this issue appeared to be every bit as absurd as their allegation of theft. Consider this:

When acting under explicit, documented instruction to acquire SV's personal data, VARS Technology are NOT a data controller.
When NOT acting under explicit, documented instruction to acquire SV's personal data, VARS Technology are NOT a data controller.

Once again, VARS Technology's illogical reasoning comes to the fore. VARS Technology would surely agree that when they are acting only under explicit, documented instruction to acquire and process personal data they would be solely a data processor. There is no argument with this view. On the other hand, in the current 'case' VARS Technology were certainly not acting under explicit, documented instruction when they acquired SV's personal data (i.e., they were acting entirely of their own volition) and there was documentary evidence from more than one source to that effect. Yet they continued to insist they were solely a data processor. They were not. There can be no doubt, in this 'case', they were the data controller for SV's personal data. Are there any circumstances whatsoever, then, whereby VARS Technology might accept that they are acting as data controller? There are. Interestingly, at the time, VARS Technology appeared on the ICO's Register of Data Controllers and they had no problem labelling themselves as data controller when operating the parking enforcement arm of their business, which also relies on their ANPR technology and their KADOE contract with DVLA. From their Complaints Policy at the time (bold added):

"Please note, when a complaint concerns the issuing of a Parking Charge Notice issued by us, VARS Technology LTD are the data controller."

So it appears that VARS Technology were illogically claiming that when their ANPR technology is located at service station forecourts they are never data controllers, but when their ANPR technology is located in car parks they are always data controllers.

In their forecourt operations, VARS Technology hold an ongoing repository of images of vehicle registration plates for the purposes of identifying vehicles which they have identified as being previously involved in drive off events. These images are collected from ANPR technology which, according to the legal representative of at least one chain of forecourts, is owned and operated by VARS Technology, and operating independently of any instruction from the forecourt sites on which they are situated. Based on the ANPR visual captures (and, as is now clear, even sometimes based on what is not present in the visual captures) VARS Technology then collect personal data (or not) of registered keepers, absent any instruction from the forecourt, by their own decision, and through their own contractual arrangement with DVLA. This is a textbook description of a data controller, meeting the definition of data controller not only as laid down by Art 4(7) of UK GDPR 2018 but as adjudicated by courts in several EU countries as well. So, once again, SV replied (bold added):

"You are obfuscating the issue and ignoring my lawful request to address your use of my personally identifiable information. I'm asking solely about my personally identifiable data. The photograph.......clearly does not include any personally identifiable data regarding me or my vehicle."

Exasperated, she then shifted from a request for deletion of data to the submitting of a Subject Access Request (SAR):

"Therefore, under the provisions of the Data Protection Act and the UK GDPR I formally make a Subject Access Request for any and all data VARS Technology hold on the registration plate F****** and any personally identifiable information emanating from this number plate. In particular I would like you to furnish me with the wording of the application made to DVLA to substantiate your necessary claim of just cause to acquire such information."

This SAR was in no way ambiguous. It was a specific request for data that VARS Technology alone had "collected.......in the first place." However, when confronted with this perfectly legal request to which they had an obligation to respond, VARS Technology still would not comply despite admitting that the specific document she had requested was in their possession (bold added):

".......your Subject Access Request would need to be submitted to the correct party, our client EG……The only documentation we have in our office with the vehicle registration is the DVLA application, the response form and the notice issued to you."

VARS Technology were blatantly ignoring their legal obligations. According to the ICO any company dealing with personal data is expected to have public facing staff trained and able to identify a SAR and to direct that request to the responsible person; a data subject making a SAR request should not have to wade through organisational bureaucracy. At the very least this reply should have been forwarded to VARS Technology's designated Data Protection Officer for action, not left to a low-rank employee working from a repetitive script. Even a genuine data processing company cannot 'dead end' a SAR on the basis that it has been misaddressed. If they insisted on claiming to be only 'processing' SV's data, VARS Technology still had a legal duty to act, according to the ICO, "promptly forwarding any request" to ESSO Braywick (or their parent company, as postulated data controller) in accordance with Art. 28(3)e UK GDPR 2018. VARS Technology would know this.

The irony burned bright too; the DVLA application included in "the only documentation we have in our office" was precisely what SV had included in her SAR. She didn't simply ask to be given a list of documents held by VARS Technology; she was asking for an actual copy of that document. It was, of course, blindingly obvious why VARS Technology were ignoring legitimate requests. They were not aware that SV had already sourced the DVLA application, so they were attempting to 'dead end' all data requests by pointing SV to ESSO Braywick. The forecourt were obviously an informational 'dead end' as no personal data pertaining to SV had been collected by the forecourt and ESSO Braywick had not made the DVLA application. To labour the point, as ESSO Braywick's solicitor once again put it (bold added):

"We do not hold any communications with VARS regarding your personal data. Each site uses automatic number plate recognition software to identify registration plates that enter our forecourts. VARS.......manage any offences that occur in relation to a vehicle automatically once receiving notification of this through their systems."

VARS Technology were making themselves look foolish. When SV informed ESSO Braywick's solicitor that VARS Technology had refused to comply with the SAR, they appeared to have deduced what VARS Technology apparently could not; that SV had already received the DVLA document. Nevertheless, they offered to approach VARS Technology, on SV's behalf, to request they provide it. In the end, however, VARS never provided any documents.

•VARS Technology Finally Forced To End Their Scam•

Playing along with VARS Technology's data protection shenanigans, SV next sent a SAR via signed post to ESSO Braywick. This included the following carefully worded specific requests:

Please provide any and all untampered footage and any and all untampered still images captured by cameras on your premises on 11 September 2024 which includes the vehicle with registration number F****** and the driver. Still images should include any available unaltered EXIF information.
Please provide any and all untampered footage/still images captured by cameras on your premises on 11 September 2024 of any other vehicle referenced in VARS Technology incident number EG*********.
Please provide the full and unredacted application made by yourselves to the DVLA for the personally identifiable information of the keeper of the vehicle with registration number F******.
Regardless of whether you can supply footage/still images of the vehicle F****** and/or the driver can you confirm that under your contractual arrangement with VARS Technology you have explicitly instructed them to act as a data processor for any personally identifiable information concerning and originating from registration number F******?

SV knew it was impossible for ESSO Braywick to possess any video footage or still photographs containing her vehicle registration mark or her physical image. Nor was it they who had applied to the DVLA for SV's personal data. The expectation was, therefore, that much (if not all) of the SAR would be legitimately declined by ESSO Braywick's legal adviser on the bases that:

disclosing such would be an obvious breach of the driver's personal data as the driver in the CCTV footage and any still images captured from that footage was obviously not SV; and/or
that the registration mark F****** referenced in the SAR differed from the registration mark on the vehicle in their CCTV footage; and/or
that they possessed no data of any kind depicting any vehicle with the registration mark F******; and/or
ESSO Braywick had never made a KADOE application for the personal details of the keeper of the vehicle F******; and/or
ESSO Braywick had not explicitly instructed VARS Technology to process personal data concerning and originating with the registration mark F******.

If refusal or inability to provide on any single one of these grounds obtained, it would have immediately nullified VARS Technology's 'case' as it would constitute a clear admission, from the party they had persistently identified as the sole data controller, that neither the registration mark F******, nor the registered keeper was involved in any way with the alleged drive off event. It would also be confirmation that VARS Technology were acting alone, and that their processing of any personal data related to the registration mark F****** was not being performed on behalf of their postulated data controller; i.e., their 'case' was, in effect, a wholly fictitious scenario of their own fabrication. Despite stating that she was happy for them to communicate back via email, this SAR went unacknowledged by either ESSO Braywick or VARS Technology. Instead, six days later, on 27 November 2024, VARS Technology emailed SV (bold added):

"As we have maintained through our correspondence, we have wished to resolve the matter with you. We have contacted the forecourt continuously in order to do so and they have confirmed that CCTV is no longer available, therefore, they wish to close this claim. We can confirm that claim has been closed and no further action will be taken."

VARS Technology were still peddling the story that they were operating their scam wholly under the guidance of ESSO Braywick. According to them, it was not VARS Technology that had closed the 'claim' but "they wish to close this claim." This later proved to be untrue.

•Further Confirmation That VARS Technology Were Acting Of Their Own Volition•

The scam was ended but SV's SAR was still being ignored. The question arose, then, as to whether the CCTV 'evidence' had been purposely deleted by ESSO Braywick in an attempt to protect VARS Technology from continuing to make fools of themselves. s.173 of the Data Protection Act 2018 makes it an offence to block, erase, destroy or conceal information with the intention of preventing disclosure. To ascertain whether this was the case SV submitted a second SAR by signed post to ESSO Braywick, identical to the first with an added request of the date of deletion of the CCTV data. She wrote:

"I have yet to receive either acknowledgment or reply from you.......Note that, regardless of the claim being closed the SAR still stands. You have a legal obligation to provide the information I have requested. VARS Technology's decision and email in no way absolves you, as the data controller in this matter, from your obligations under Article 15 of the Data Protection Act 2018 (UK GDPR)……...If you are unable to provide any of the information I have requested, please supply the date(s) on which my personally identifiable information was permanently deleted from your databases."

A week later, ESSO Braywick's solicitor emailed, informing SV (bold added):

"In relation to your data subject access request, our CCTV is held on a 30-day retention basis and so unfortunately, at the time of your original request to VARS……..footage from 11 September 2024 had been automatically deleted……..As requested in point 5 of your letter, the date of deletion was 30 days following the incident and so was on 11 October 2024."

Note the dates here. The CCTV 'evidence' was deleted on 11 October 2024. The first demand letter to SV was issued by VARS Technology on 30 October 2024. Regardless of what it did or did not depict, the CCTV footage had been deleted by ESSO Braywick almost three weeks before VARS Technology posted their first demand letter. The Data Protection Act 2018 states that CCTV footage should only be kept for as long as is necessary, which accounts for the 30-day retention policy, considered a standard time frame for the retention of non-critical data. However, if a bona fide drive off event was captured, the CCTV footage of the event would have provided crucial evidence for the purpose of both criminal prosecution or civil litigation, giving ESSO Braywick a perfectly lawful reason to preserve the footage. The clear implication, therefore, is that the forecourt did not consider the footage to be important and had no further interest in legally pursuing this alleged drive off event. This might be because a bona fide drive off event was the case, but the chances of identifying the alleged culprit were slim to none given the poor quality of the image and the cloned/altered registration plate. Another possibility is that VARS Technology's whole claim was fictitious and no drive off event had occurred at that time and location. The image in the demand letters was not date or time stamped and no one other than VARS Technology had either claimed or confirmed that the image they provided involved the theft of fuel. Whatever the reason, VARS Technology would certainly have been aware of the forecourt's general 30-day retention policy, as well as their decision to delete the evidence. For, according to VARS Technology, throughout their 'case':

"We have contacted the forecourt continuously."

It seems to be the case that VARS Technology routinely initiate their drive off scams knowing that CCTV evidence is unavailable. After submitting a SAR to forecourts, many victims have found that the CCTV footage of the alleged drive off event had been deleted well before VARS Technology had sent their first demand letter. One respondent found that CCTV footage had been deleted 47 days before VARS Technology sent their first demand letter, while another reported receiving a letter on 15 September for an alleged drive off event on 2 July. By providing the date of deletion in SV's case, the forecourt's solicitor effectively confirmed that VARS Technology had been conducting the drive off scam entirely of their own volition. They even stated as much (bold added):

"VARS uses its own technology to capture licence plates" going on, "the data retention limits from the CCTV are unrelated to VARS case."

Thus, VARS Technology were clearly untruthful as to their reason for closing their 'case'. It wasn't any sudden realisation of a lack of CCTV evidence. VARS Technology possessed exactly zero evidence of SV's guilt from the time of the alleged drive off event itself. Even if available to them, no CCTV footage of this alleged drive off event was ever going to be relevant to their 'case', a fact obvious to any reasonable person. It is more likely the real reason for VARS Technology ending the scam was the realisation that it had run its course. It appeared that SV was never going to concede and, if VARS Technology had insisted on proceeding to the legal end, they would have had to invest money into a venture they knew they could not possibly win. They were wise to capitulate; SV was prepared to fight them all the way to a courtroom. She definitely would have done this, and in as public an arena as possible. The lack of CCTV evidence simply gave VARS Technology an opportunity to end the scam in the same manner in which they had pursued it; by attempting to shift accountability away from themselves and onto the forecourt.

•VARS Technology's Continued Noncompliance With Data Protection Law•

This particular instance of VARS Technology's drive off scam was now doomed. However, there was still the matter of SV's personal data. Notably absent from VARS Technology's capitulation was any mention of the permanent deletion of her data. SV recontacted VARS Technology:

"As the purpose of your holding my personally identifiable information is no longer valid please confirm that any and all of my personally identifiable information has been permanently deleted from Vars Technology databases and any hard copies destroyed. Please provide dates on which these actions were implemented."

This request was well within the requirements and obligations set out in data protection legislation, e.g., Art.5(1)(e) UK GDPR 2018. The ICO list specific circumstances all of which, considered alone, should guarantee deletion of personal data on request. They include:

The data is no longer needed for the initial purpose it was collected.
The data subject objects to the use of the data.
There are no overriding legitimate grounds to retain the data.
The data was collected unlawfully.

All four of these criterion were applicable here. Indeed, all were equally applicable on her very first request for deletion, made on her very first response to the drive off scam. According to Art.5(2) of UK GDPR 2018, the burden of proof for the legality of holding any subject data is always on the controller, but even if VARS Technology had wished to persist with the highly dubious notion that they were merely a data processor in the matter of SV's personal data they would still have had to conform to the deletion request. As Art.32 UK GDPR 2018 states:

"…….on termination of the processing activities the processor must…….delete or return all the personal data to the controller and delete existing copies."

Of course, VARS Technology would be unable to return any of SV's personal data to ESSO Braywick for deletion because their solicitor had confirmed that they never had, and currently did not, hold any of her personal data. To comply with legislation, therefore, VARS Technology's only lawful option was to delete on request. After one week, however, there was no reply. So a follow up email was sent:

"I have not received any response to the email I sent you…….Please can you confirm as per my request and provide the relevant date for actioning."

VARS Technology finally replied to SV and the response was quite astonishing. Art.12(4) of UK GDPR 2018 states that an explanation must be given if a refusal to delete data is made. VARS Technology did that, but the reason they gave grossly misrepresented their legal position. They were also typically curt (bold added):

".......we can confirm that the claim was closed....... as a result, any data that we are not required to keep for contractual obligations had been removed on the date this was closed.......No further action will be taken and any data we are not required to keep has been removed."

Given their abject loss of face, one might expect VARS Technology to at least try to be a little contrite. Sadly not. Scammers never apologise. The words "not required to keep", could only mean one thing; VARS Technology were refusing to delete the entirety of SV's personal data. This was confusing, because, as outlined earlier, the only personal data they ever claimed to hold was the discredited image from their ANPR equipment and their deceptive application made to the DVLA, along with the two demand letters they sent. So, what personal data were they deleting? Had they unlawfully acquired additional personal data? If so, did those so-called "contractual obligations" relate to unlawfully providing (even selling) SV's personal data to third parties? SV continued to badger them:

"You emailed me…….to inform me that the case was closed and no further action. Please can you confirm that this was the date that my personally identifiable information was removed. If not please provide the specific date."

Note that VARS Technology's disingenuous attempt to hide behind "contractual obligations" was the sole reason given for denying SV her statutory right to deletion. Not once did they expand on those "contractual obligations", but even if they had their explanation would be unlawful and unconvincing because firstly, it is not possible to contractually 'opt out' of data protection legislation and secondly, data collected for one initial purpose (to issue a speculative invoice to extort money) cannot be used for a second purpose (to comply with unexplained contractual obligations). Put simply, there is no legal basis by which a company can unlawfully collect personal data, even accidentally, and then refuse to delete it at the data subject's request, due to "contractual obligations" or otherwise. Art.14 UK GDPR 2018 states (bold added):

"Where the controller intends to further process the personal data for a purpose other than that for which the personal data were obtained, the controller shall provide the data subject prior to that further processing with information on that other purpose and with any relevant further information……."

Under the principles of transparency, data minimisation and storage limitation set out in Art.5 UK GDPR 2018, VARS Technology was obligated to not only explain to SV why her data was being retained, but specifically what information will be kept, and for how long. If a company cannot articulate a specific legally permitted exemption under Art.17(3) UK GDPR 2018 (and VARS Technology most definitely could not) they are obligated to comply immediately with a deletion request. VARS Technology did none of these things. Thus, SV quite rightly considered VARS Technology's derisive attitude to data protection legislation to be intolerable, so she penned a strongly worded return email:

"The legal situation is very clear; you are not allowed to retain personally identifiable data other than for the purpose for which it was specifically collected. Your reply indicates that you are retaining some of my personally identifiable data despite the purpose for which it was collected being no longer valid. Therefore, I wish to know exactly what personally identifiable data you have retained……..Please note that any contractual obligation you have entered into cannot override data protection legislation. In particular, it is unlawful to retain personally identifiable data 'in case' it may be 'required' in the future. In accordance with data protection legislation, I expect you to delete my personally identifiable data in its entirety. Please confirm that you have done so and if you are unwilling to do this please provide the legal reasons you are relying on for not doing so."

The comment about retaining data 'in case' it may be needed in the future was especially pertinent because simply storing data and not acting upon it in any other way is still classed as processing data per Art.4(2) UK GDPR 2018. This demand finally brought VARS Technology to their senses and they deigned to comply. The VARS Technology employee who replied to SV was customarily short:

"To ensure full compliance with your request, any identifiable data has been deleted and is no longer associated with this reference."

No apology was forthcoming. Even at the very funeral of their scam VARS Technology had neither the courtesy nor the courage to admit they had done anything wrong. They even took the tone that they were doing SV a favour; "full compliance with your request" should have read "full compliance with data protection legislation", a point later confirmed to SV after she checked with ESSO Braywick's solicitor (bold added):

"Once you put a data deletion request in, companies are required by law to abide and so will not retain any data and therefore, there is no data responsive to your request that I can provide you with."

As a registered data controller VARS Technology are legally bound to have a designated Data Protection Officer. One would expect that an ethical and competent Data Protection Officer would have been highly concerned with the manner in which VARS Technology conducted themselves throughout this 'case'. The fact that no such person ever identified themselves or was ever referred to by others in communications suggests that that the Data Protection Officer either had no knowledge of the scam, which is highly unlikely, or they turned a blind eye. Their absence strongly suggests that the scam operated as company policy, whether performed with the knowledge of their Data Protection Officer or not.

•Why Did VARS Technology Refuse Data Deletion?•

Given VARS Technology's proclivity to being untruthful and their cavalier attitude to data protection legislation, it seemed prudent to consider the possibility that they hadn't actually deleted SV's personal data. Perhaps we'll never know. Should VARS Technology recontact SV at any future time, including in regard to this website, they would be continuing to process unlawfully acquired data after falsely claiming to have deleted it, as well as re-purposing it without consent. Similarly, if the F****** registration mark is found to be blacklisted on any VARS Technology protected forecourt that would also be prima facie evidence that they haven't deleted (now out of date and erroneous, more so unlawfully held) personal data. The case reference number they provided did vanish from the pay portal on the VARS Technology website, but that alone is no guarantee. If it does transpire that VARS Technology have retained any of SV's personal data, it could only be for some nefarious reason. One such plausible reason would be to keep the door open to resurrect the scam. By way of example, the following report of a VARS Technology drive off scam shows some striking similarities to SV's 'case' (from a female victim on Trustpilot; bold added):

"I had my registration plates stolen off my car, I reported it to the police, obtained a crime reference number. Weeks later somebody had stolen fuel from a petrol station, picture evidence of two men and a different colour car with my stolen registration plates on. After months of back and forth with this company trying to prove and defend myself they finally told me they'd closed the case! Only that's not what they did! They had sold this debt onto a debt collection agency who then pursued me to pay this outstanding balance which was not done by me! They lied......"

Similarly, reports of VARS Technology continuing to pursue drive off 'cases' when the forecourt has been paid, and there is evidence they have communicated this fact to VARS Technology, can also be found. The legal basis for doing this is also questionable. A person who pumps fuel forms a contract with the forecourt and when payment has been made to the forecourt's satisfaction the contract is effectively fulfilled and completed. Thus, VARS Technology's issuing, to that person, of further invoices, which include the cost of fuel, would be fraud. Another, albeit unlikely, possibility is that they might sell the 'debt' on to a third party. However, if VARS Technology were found to sell an alleged drive off 'debt' on, this would place them in direct contravention of their KADOE contract. VARS Technology are free to have a third party act on their behalf, but they cannot transfer personal data while relinquishing legal rights to the debt. As the DVLA state:

"DVLA will not allow vehicle keeper data originating from DVLA records to be provided to third parties as part of a debt assignment arrangement. The Agency will consider disclosure of data obtained from DVLA to third parties as part of a debt assignment arrangement as a breach of contract."

In SV's 'case', the KADOE application signed by a VARS Technology company director also states that personal information can only be passed on to a third party with permission from the DVLA. Should a third party attempt to pursue payment from SV at a later date, they would also be inviting losing any court proceedings not only due to the absurd paucity of evidence and/or clear breach of the KADOE contract, but also via a defence of 'estoppel by representation'. This legal manoeuvre prevents a claimant from enforcing any debt, either by themselves through their own legal representatives or by a third party, if a prior statement has been issued to the defendant that the case is closed and the 'debt' is no longer owed.

•Conclusion•

VARS Technology do perform legitimate work by pursuing payment for bona-fide, criminal drive off events, i.e., where the accurately identified driver has intended to steal fuel and tangible, believable evidence supports this allegation. The litmus test for whether a claimant like VARS Technology has a viable legal case is that they are able to present an articulate and logical argument based on sound evidence. However, there is ample and growing anecdotal evidence suggesting that where the alleged perpetrator of fuel theft cannot be identified, or their ability to collect an alleged debt under contract law is otherwise thwarted, VARS Technology appear to resort to concocting fictitious scenarios, based on insufficient or even no evidence, in order to procure money from parties they must be aware are innocent. There can be no doubt this is what occurred in the case study presented here.

At no point in their correspondence with SV did VARS Technology make any attempt to present a viable logical and/or lawful basis for their 'case'; at no point did they present any palpable evidence whatsoever, and at no point did they show any semblance of acting in good faith. On the contrary, they consistently mimicked well documented scammer red flags and, over the two months they spent conducting their scam, appeared to not be at all concerned with the impression they were giving. The almost unanimous tenor of consumer reviews dealing with VARS Technology suggests that the behaviour and attitude described here in this case study is not at all anomalous.

In addition, VARS Technology do next to nothing to counter the growing resentment of their unethical practices. They have an apparent policy of ignoring consumer criticism. On Trustpilot, for example, where companies are permitted (and encouraged) to interact with individual complainants, VARS Technology is conspicuously absent. Nevertheless, there is one 'review' on the site written by someone calling themselves 'Dillon'. At time of writing, it was Dillon's only review and the sole contribution awarding VARS Technology 5-stars (bold added):

"As someone who used to work for VARS I can assure everyone that they are a legitimate company who don't pursue anyone unless directed so by a forecourt. Even then the evidence needs to be conclusive. They work tirelessly to make our parking and forecourts more safe and even work with the Police, other security companies and the DVLA. If you're angry it's likely you messed up and need to own your mistakes a little better."

We can dismiss this effort outright. It appears to be from the same repetitive scam scripts encountered in the present case study. Each of the first two sentences contain statements which are demonstrably untrue with regard to the present case study. This contribution only makes sense if 'Dillon' is a 'sock puppet' account. The second offering comes directly from an unnamed spokesperson at VARS Technology, quoted in the Guardian article of 20 December 2025 (bold added):

"Incidents like those flagged up are rare, and when they do happen, we make every effort to resolve them promptly and fairly."

This statement could be considered as a partial admission; their scams are sometimes flagged up, albeit rarely. However, given their behaviour in the current case study, could any reasonable person consider this response to come anywhere near to ringing true? Neither of these examples address any specific issues that their scam victims raise, both here and elsewhere. It speaks volumes that these two brief boilerplate responses consist of nothing more than enfeebled denials. Arguably, this is the best that can be mustered in defence of VARS Technology's drive off scams.

"Falsehood flies, and the truth comes limping after it; so that when men come to be undeceived, it is too late, the jest is over, and the tale has had its effect." (Jonathan Swift)

This article is provided in the public interest. It is licensed under Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International. Click here to read the full licence. Short version: Feel free to share this work widely (attribution back to this website would be appreciated). The author can be contacted at dandyodds@driveoffscam.uk

No personal data is collected by this website, except for that voluntarily disclosed by emailing the author. No cookies are set directly nor are any cookies set by any third party. ISPs and IP addresses are not identified and no browser fingerprinting or tracking technology is used.