ParkingEye Text Scam: How Fake Parking Messages Work
A ParkingEye text scam is currently circulating in the UK, with fraudulent messages pretending to come from ParkingEye and claiming that the recipient has an unpaid parking charge. The texts typically direct people to a payment link and create pressure to act quickly.
ParkingEye has confirmed that these messages are fraudulent. The company states that it does not send parking charges by text or email. Genuine ParkingEye parking charges are sent by post and include information such as a reference number, location and date.
Interest in the scam has risen sharply. Google Trends data for the UK over the past month shows searches including "eye parking text scam", "parking eye text scam" and "parking eye scam" increasing substantially, with several related searches classed as Breakout queries.
The incident is another example of a wider problem facing legitimate organisations: criminals do not need to compromise a company's systems to damage trust in its name. They can simply impersonate it.
Contents
- What is the ParkingEye text scam?
- What does the ParkingEye scam text look like?
- Why parking scams are effective
- How brand impersonation works in SMS
- What the ParkingEye scam tells us about sender verification
- New Ofcom rules for business messaging
- What to do if you receive a ParkingEye scam text
- What businesses and messaging providers can learn from the scam
- Key takeaways
- Frequently asked questions
- Protecting trusted brands before messages reach subscribers
What is the ParkingEye text scam?
The ParkingEye text scam involves messages sent by criminals who pretend to represent ParkingEye, a genuine UK parking management company.
The message tells the recipient that a parking payment or parking charge remains outstanding. It then presents a link where the supposed charge can be paid.
ParkingEye says the wording varies, but the messages generally follow the same pattern. Recipients are told that a payment has not been settled and are warned that extra charges or other consequences could follow if they do not act. The message then directs them to a website.
The link is the important part.
Rather than sending the recipient to ParkingEye's legitimate website, the scam directs them to a website controlled by the criminals. ParkingEye has warned that examples have used unusual web addresses containing random characters.
Once somebody reaches the fraudulent site, they may be asked for information such as their vehicle registration, personal details or payment card information.
This is a form of phishing conducted through SMS, often referred to as smishing.
What does the ParkingEye scam text look like?
There is no single version of the ParkingEye text scam, which makes looking for an exact sentence or template unreliable.
ParkingEye has identified several recurring warning signs. Scam messages may:
claim that a parking fee or session remains unpaid
pressure the recipient to make an immediate payment
threaten increased charges or other consequences
contain a link that does not use the official parkingeye.co.uk domain
contain no genuine Parking Charge reference number
omit the location or date of the supposed parking incident
ask for vehicle or payment information through the linked website.
Some versions use a particularly revealing trick. ParkingEye says recipients have been instructed to reply "Y" or "Yes", close the message and reopen it so that a link becomes active. Others are told to copy the address manually into their browser.
That instruction should immediately raise suspicion.
The technique attempts to overcome protections on phones that can restrict links received from unknown senders. A genuine parking charge would not require a customer to bypass their phone's security features in order to pay it.
Why parking scams are effective
Parking makes a useful subject for impersonation because uncertainty is built into the situation.
Someone might have used several car parks recently. They may have paid through an app, entered their registration at a terminal, used contactless payment or assumed that automatic number plate recognition had recorded their stay.
A message claiming that a payment has failed can therefore arrive at just the right moment to create doubt.
The amount involved may also be small enough to make immediate payment feel easier than investigating the claim. Add a short deadline or a warning about higher charges and the scammer creates pressure to act before checking.
This pattern is not unique to ParkingEye. Fake parking charge messages have circulated in the UK for some time. The DVSA warned in September 2024 about fraudulent texts claiming that recipients had outstanding parking penalty charges, despite the agency not issuing parking fines.
The ParkingEye example adds another ingredient: brand recognition.
A recipient who recognises the name may judge the message by the organisation being impersonated rather than by the actual sender.
That distinction matters.
How brand impersonation works in SMS
Most people do not examine the telecommunications infrastructure behind every message they receive.
They make faster judgements.
Does the organisation sound familiar? Is the scenario believable? Does the message look professional? Could I genuinely owe this money?
Criminals exploit those shortcuts.
Ofcom describes business messaging scams as cases where criminals gain access to business messaging services and impersonate legitimate organisations, such as parcel companies or government agencies, to persuade recipients to follow fraudulent links, make payments or provide sensitive information.
The business being impersonated does not need to have suffered a security breach.
ParkingEye's systems could be entirely separate from the criminal operation. The scammer benefits from the company's identity simply because consumers recognise it.
This creates two victims.
The individual risks losing money or personal information.
The legitimate brand suffers because customers become less certain that its communications can be trusted.
That erosion of confidence can extend beyond a single scam campaign. If customers repeatedly see fraudsters using well known brands in texts, the credibility of business messaging itself begins to weaken.
Ofcom highlighted this problem when finalising its latest mobile messaging protections in July 2026, noting that scam messages cause harm to both individuals and businesses.
What the ParkingEye scam tells us about sender verification
Advice to consumers remains essential. People should check links, question unexpected payment demands and verify messages independently.
But asking every customer to identify every sophisticated impersonation attempt cannot be the only defence.
There is a network level question as well:
Who was permitted to send the message in the first place?
That is where sender verification becomes important.
A messaging provider should be able to establish that the organisation requesting access to business messaging is genuinely who it claims to be. The identity being presented to recipients should also be consistent with the verified business behind the account.
This is where processes such as KYC, Know Your Customer, and KYB, Know Your Business, become relevant to telecommunications.
Brand Assure is built around this part of the problem, using multiple sources for KYC, KYB and OSINT based validation across messaging and voice environments. The objective is to give mobile networks and CPaaS providers more evidence about the organisations seeking to use their infrastructure before those organisations reach subscribers.
No verification process can guarantee that fraud disappears.
It can, however, make it harder for an unverified or misrepresented business identity to gain access to trusted messaging channels unnoticed.
The distinction between recognising malicious content and validating the entity sending it is important. A message may contain perfectly ordinary language. The stronger signal may be that the business identity, Sender ID, sending behaviour and stated purpose do not fit together.
New Ofcom rules for business messaging
The timing of the ParkingEye text scam is particularly relevant because the UK regulatory approach to fraudulent business messaging has just changed.
On 15 July 2026, Ofcom finalised new rules and guidance intended to strengthen protections against mobile messaging scams.
For business messaging, Ofcom says mobile operators and aggregators must carry out upfront and ongoing due diligence on business message senders. This includes effective Know Your Customer checks and ongoing Know Your Traffic monitoring.
The rules also address alphanumeric Sender IDs, the names that can appear instead of a telephone number when a business sends an SMS.
Providers are required to corroborate the Sender IDs used by business message senders against information gathered about the organisation. Ofcom gives the example of a company presenting itself as a hairdresser but sending parcel delivery messages, which could indicate fraudulent activity.
Providers are also expected to maintain policies covering protected and generic Sender IDs, operate incident management processes and act on reports to identify and block malicious senders, links and phone numbers.
These requirements shift part of the fraud prevention burden further upstream.
Rather than relying exclusively on detecting a suspicious message after it has been sent, providers are being asked to understand who is sending business traffic, what identity they are entitled to use and whether the traffic matches the expected behaviour of that organisation.
The ParkingEye impersonation campaign shows why that distinction matters.
What to do if you receive a ParkingEye scam text
ParkingEye's own advice is straightforward: do not click the link, do not reply and do not enter any information.
If you are unsure whether you genuinely owe ParkingEye money, do not use the contact details or website included in the message. Access ParkingEye independently through its official website.
ParkingEye says genuine Parking Charges are sent by post rather than text and contain a reference number, location, date and instructions explaining how to pay or appeal.
Suspicious texts can also be forwarded to 7726.
The National Cyber Security Centre says most UK mobile providers participate in the 7726 scheme. Forwarding a suspicious text allows the provider to investigate its origin and potentially block or ban the sender if it is malicious.
The service is free. GOV.UK also recommends forwarding suspicious text messages to 7726.
If you have already entered card information or made a payment, contact your bank immediately. ParkingEye also advises changing reused passwords if one was entered into a fraudulent site.
People who have lost money or been hacked after responding to a phishing message can report the incident to Report Fraud in England, Wales and Northern Ireland. In Scotland, incidents can be reported to Police Scotland.
What businesses and messaging providers can learn from the scam
The ParkingEye text scam is useful because the fraud itself is simple.
There is no need for a complicated technical story.
The criminal borrows a recognised identity, creates a believable reason for payment, introduces urgency and sends the recipient somewhere controlled by the attacker.
That simplicity is precisely why sender identity matters.
For mobile networks, CPaaS platforms and other organisations carrying business messaging traffic, several questions become increasingly important:
Has the business sender been properly verified?
Is the organisation entitled to use the Sender ID it has requested?
Does the traffic match the stated purpose of the account?
Has the sender's business information changed since onboarding?
Are unusual traffic patterns triggering further review?
Can decisions and verification outcomes be audited later?
Content filtering still has a role. Suspicious URLs, unusual sending patterns and known malicious destinations can all provide useful indicators.
Identity adds another layer.
If a provider understands the organisation behind a messaging account, its legitimate brand names and the expected purpose of its traffic, suspicious discrepancies become easier to identify.
Ofcom's new requirements formalise much of this direction by combining sender due diligence, traffic monitoring, Sender ID corroboration and incident response.
For genuine brands, there is a broader lesson too.
Fraud prevention is becoming part of brand protection.
Customers need to know not only what legitimate communications look like, but also that the messaging ecosystem has controls designed to prevent someone else from presenting themselves as that brand.
Frequently asked questions
-
If you receive a text claiming to contain a ParkingEye parking charge or asking you to pay one through a link, ParkingEye says it is fraudulent. ParkingEye states that it does not send parking charges by SMS or email. Genuine Parking Charges are sent by post and include a reference number, location, date and information explaining how to pay or appeal.
-
ParkingEye says it does not send its Parking Charges by text or email. If a text claims that you have an outstanding ParkingEye charge and directs you to a payment website, do not use the link. Access ParkingEye through its official website independently if you need to check whether a genuine charge exists.
-
Do not click the link, reply to the message or enter personal information. ParkingEye recommends forwarding the message to 7726 and then deleting it. The NCSC confirms that 7726 allows participating mobile providers to investigate suspicious texts and potentially take action against malicious senders.
-
Contact your bank immediately if you entered payment details or transferred money through a fraudulent website. ParkingEye also recommends monitoring your statements and changing a password anywhere else it has been reused if you entered one on the fake site. Victims who have lost money or been hacked should also report the incident through the appropriate UK fraud reporting service.
-
An alphanumeric Sender ID is the name displayed as the sender of some business SMS messages. Criminal use of misleading identities can make fraudulent messages appear more credible. Ofcom's July 2026 measures require business messaging providers to corroborate Sender IDs against information gathered about the business sender, alongside KYC and traffic monitoring requirements.
Key takeaways
The ParkingEye text scam is a confirmed impersonation campaign. ParkingEye says fraudulent messages are being sent in its name and that it does not issue parking charges through text or email.
The scam works because a recognised business name is combined with a plausible unpaid parking charge, urgency and a fraudulent payment link.
For recipients, the safest response is to avoid the link, verify any charge independently and report suspicious SMS messages to 7726.
For the telecommunications industry, the issue goes deeper. Business messaging security increasingly depends on knowing who is sending traffic, checking that the identity they present is legitimate and monitoring whether their behaviour remains consistent with the business that was originally verified.
The regulatory direction is now clear. Ofcom's July 2026 measures require stronger due diligence, traffic monitoring and Sender ID corroboration for business messaging providers.
Brand impersonation cannot be solved by asking consumers to spot every fake. Better validation has to begin before the message reaches them.
