Strange case of the First Parking cross-site scripting attack and duplicate PCN's

creamola

This is a bit of a weird one – for which I would value your advice:

In November, my wife found a ticket from First Parking stuck to her windscreen at Bath Uni.

We weren’t unduly concerned, because she works there and has a valid staff parking permit which was displayed in the car - parked in her own permit space outside her office. So, onto First Parking’s website she went, and typed in the appeal. HOWEVER, on hitting the “Submit” button, the browser threw an error suggesting that the First Parking website had been compromised in a cross site scripting attack.

I therefore did a bit of detective work and discovered that First Parking’s website is created and managed by a chap *named removed by MSE Forum Team* at dynamicsonline.co.uk. I therefore emailed *removed by Forum Team* and started getting responses from him as support@firstparking.co.uk - which culminated with an email from *Removed by Forum Team* two days later once I had confirmed to him that the problem was now fixed and I was able to submit the appeal: “We have lots of protection in place to such prevent attacks, but always value any real world experience of this kind. I appreciate your comments and will feedback to the right person for discussion and any further action”.

A day later, my wife received an email from *removed*, Appeals Manager at First Parking which said “After reviewing the photographic evidence and also your appeal information; on this occasion I will accept your appeal however, it is the drivers responsibility to ensure they are clearly displaying a valid permit.” before concluding with “Please consider this matter closed”.

Imagine my surprise, when yesterday, I received a Registered Keeper PCN from First Parking for the same car park, same car, same date and same reason “Parked without Parking ticket/permit” but:

1. Date of event listed as 22/11/16 with a date of PCN issue of 03/01/2017.

2. A DIFFERENT PCN number to that originally issued and appealed above.

IF First Parking’s website has been hacked, it will call into question any PCN’s they issue – particularly if, for the same event, they are belatedly sending me a Registered Keeper PCN with a completely different number.

Whatever, I still need to do something about it, but what should I do – and in what order?

Thanks on advance!

Half_way

Sounds like the usual PPC incompetence at work, why hasn't she contracted her employer about this mess?

creamola

Well, I only received the Registered Keeper PCN yesterday and before then, we considered the issue done and dusted.

If she should contact her employer, that is indeed what I will ask her to do - but is that it? i.e. given the timing of the Registered Keeper PCN being greater that 14 days after the supposed offence, is that also grounds to appeal? (I have just written to the DVLA thanks to the example letter from pappa golf)

Coupon-mad

The appellant should email Leanne Kay, Appeals Manager at First Parking and ask what they are playing at! Simple as that.

BTW, my experience of getting a student off a F1rst Parking ticket at Bath University last year was exactly the same (bar the website fault). They backed down when appealed, very easy, in similar circs of a car which was displaying a permit all along. I did include other arguments and wrote as the registered keeper (a relative) but I didn't need any of it.

I think F1rst might have to cancel PCNs as part of their contract, where it's a first time issue and the appellant is a permit holder all along.

given the timing of the Registered Keeper PCN being greater that 14 days after the supposed offence

Irrelevant as it sounds like the driver appealed (a mistake/not recommended) instead of the keeper. No POFA deadline applies, 'keeper liability' arguments were in the bin, not that it mattered for you both but the driver should never appeal.

Is the date and time of the PCN the same as the windscreen PCN?

creamola

Thanks for this.

So here's the thing: the driver appealed the first PCN - because it was a ticket stuck on the windscreen and she had a permit so it seemed like and open and shut case (which it was once she had received the email confirming success) and so we threw the ticket away.

Yesterday, I received a Registered Keeper PCN through the post with a different PCN number (because I am the keeper and not the driver) - so there was no windscreen ticket for this one.

Coupon-mad

But it's a different time and date than the windscreen one? Or the same time/date?

creamola

Same date - but I just can't tell if it is the same time - as the time is on the Registered Keeper PCN (which I got yesterday) - but as I no longer have the earlier Windscreen ticket, I don't know what the time was on that.

In any case, she has a permit (which she pays Bath Uni, her employer, for) for the precise space she was parked in and for the precise car that was parked (the reg is printed on the permit) and the permit is stuck in the old tax disk holder (and doesn't get taken out of the car). Maybe, I should just send the bill to Bath Uni .....

pappa_golf

perhaps printing out and sending this to first , might help

Coupon-mad

creamola wrote: »

Same date - but I just can't tell if it is the same time - as the time is on the Registered Keeper PCN (which I got yesterday) - but as I no longer have the earlier Windscreen ticket, I don't know what the time was on that.

In any case, she has a permit (which she pays Bath Uni, her employer, for) for the precise space she was parked in and for the precise car that was parked (the reg is printed on the permit) and the permit is stuck in the old tax disk holder (and doesn't get taken out of the car). Maybe, I should just send the bill to Bath Uni .....

Right, so what date was the email saying it was cancelled?

I am thinking you should email the DVLA data sharing team, a scanned/signed & dated letter from you as the keeper, to find out when F1rst applied for your data:

https://forums.moneysavingexpert.com/discussion/comment/71879174#Comment_71879174

If they applied for your data AFTER they cancelled the PCN...you as the keeper have grounds to sue F1rst Parking for data misuse to the tune of £250 at least, as explained all over this forum. Not all cases tick the boxes for this fightback but if they got your data unlawfully, without reasonable cause (after the PCN was cancelled and they knew who the driver was, to boot!!) you can sue them for £250, costing you just a £25 court fee (which you also reclaim) at no risk to you.

This is the new method of fighting this nasty industry and we are only picking cases with data obtained without reasonable cause. Yours looks a possible one. Ask the DVLA for that vital date which was almost certainly at the end of December, well after the PCN was cancelled (November?).

creamola

So, the email from First Parking cancelling the original PCN of 22/11/2016 (that was stuck to the windscreen) was sent 25 November 2016.

The letter to the DVLA (using papa golf's template) is already in the Post Box.

Thanks everyone - you have been incredibly helpful and I'll tell you how it goes.

Coupon-mad

This should be interesting...keep us advised and if you hear nothing from the DVLA within 2 weeks you will need to send some sort of the response to the NTK, which we can discuss.