The Scale of Plate Cloning in the UK
Number plate cloning has become one of the fastest-growing vehicle crimes in the United Kingdom. DVLA figures obtained by Churchill Motor Insurance and published in May 2026 show that cloned plate incidents rose 53% between 2021 and 2025, reaching 11,394 reported cases in 2025 alone. Stolen plate reports rose by 30% in a single year, to 7,381 in 2025. The trajectory is unambiguous.
Plate cloning is straightforward in concept. A criminal copies the registration mark of a legitimately taxed and insured vehicle, prints matching plates, and fits them to a different car. Any offence committed by the clone is attributed to the innocent registered keeper. Criminals use cloned registrations to steal fuel from forecourts, avoid ULEZ and congestion charges, evade toll roads, defeat access control systems, and disguise vehicles linked to theft or organised crime.
The sectors most exposed are petrol forecourts, car parks, tolling infrastructure, and access-controlled sites such as fleet depots and logistics yards. Research by forecourt security firm Vars Technology found that around 13% of all forecourt drive-offs involve cars fitted with cloned plates, fake plates, or registrations with no keeper on record. For site operators, law enforcement relief is not a realistic backstop. Detection at the point of entry is the only practical line of defence.
Why Standard ANPR Is Not Enough
Automatic number plate recognition reads the characters on a plate and returns a registration string. That is what it is designed to do. The fundamental limitation is that reading a plate tells you nothing about whether the vehicle carrying that plate is the vehicle registered to it. A red Transit van displaying the plates of a silver Toyota Yaris will pass through a basic ANPR gate without triggering any alert, because the plate string itself is genuine and resolves cleanly against DVLA records.
Criminals who clone plates are well aware of this. They typically choose a donor registration that belongs to a vehicle of the same approximate type and age, reducing the chance that a casual observer will notice anything wrong. Where they are less disciplined, or where the clone is opportunistic rather than planned, the mismatch between the plate's registered vehicle and the vehicle in front of the camera can be stark. Make, model, and colour checks catch those cases immediately, and with carefully calibrated confidence thresholds they can also surface subtler mismatches that warrant human review.
The Cross-Check Principle
The core idea is simple. When a vehicle arrives at a controlled point, you do two things simultaneously: read the plate, and retrieve the registered attributes of the vehicle that plate belongs to. You then compare those registered attributes against what is physically observable. If the plate resolves to a white Volkswagen Golf and the camera is looking at a grey BMW 3 Series, you have a probable clone.
This is already established practice in commercial forecourt security. Systems that link to DVLA data show cashiers the make, model, and colour that a registration should be attached to, alerting staff to any mismatch that can indicate cloned plates. The same logic is available to developers building their own integrations through a number plate recognition API that returns vehicle data alongside the plate read in a single structured JSON response.
Making the API Call: Plate Read and Vehicle Data Together
With the NPR API, you retrieve both the plate string and the associated DVSA vehicle data in a single HTTP request. Send a POST to https://nprapi.com/api/v1/recognise with your image attached as a multipart form field named image, your API key in the X-API-Key header, and the vehicle=true flag set. That single call returns the recognised registration, a confidence score as an integer from 0 to 100, the number of credits used, and vehicle attributes including make, model, and colour sourced from DVSA data.
A minimal curl example looks like this:
curl -X POST https://nprapi.com/api/v1/recognise \
-H "X-API-Key: your-api-key-here" \
-F "image=@entry_cam.jpg" \
-F "vehicle=true"
A successful response for a single plate in standard mode takes this shape:
{
"success": true,
"registration": "AB12XYZ",
"confidence": 94,
"vehicle": {
"make": "FORD",
"model": "FOCUS",
"colour": "BLUE"
},
"credits_used": 1
}
You now have everything needed to run the cross-check: the plate string that was physically read, and the registered attributes of the vehicle that plate should belong to. The comparison between what the API reports and what your entry camera actually sees is where the mismatch logic lives.
Writing the Mismatch Logic
Confidence thresholds
Before running any mismatch check, validate the plate read itself. The confidence field is an integer from 0 to 100. A read below roughly 75 is likely to contain OCR errors and should not be used to trigger an alert or a deny action. At that score, queue the frame for manual review rather than acting on it automatically. Between 75 and 89, treat the read as provisional and weight any downstream alert accordingly. At 90 and above, the read is reliable enough to drive automated decisions.
Colour matching
Colour is the most immediately observable attribute and the most useful for live cross-checks, but it requires fuzzy handling. DVSA colour records are based on the manufacturer's declared colour at first registration. A vehicle described as "SILVER" in the DVSA record might be perceived by a camera or an operator as grey, or as champagne in certain light conditions. Build a colour synonym map into your comparison logic. At minimum, group silver and grey as interchangeable, map beige and champagne together, and treat dark blue and navy as equivalent. A mismatch that survives synonym mapping is a genuine flag. A difference within the same synonym group is not.
Make and model
Make is a strong signal when it mismatches. A plate registered to a Ford appearing on a Volkswagen is unambiguous. Model mismatches are more nuanced: a vehicle registered as a Focus Estate and observed as a Focus hatchback may simply be a trim or generation difference that is invisible from the front of the vehicle. Use model mismatches to raise the alert priority rather than as a standalone trigger. A mismatched make alone, or a mismatched make combined with a mismatched colour, is a high-confidence clone flag.
Edge cases: personalised plates and older vehicles
Personalised registrations can belong to vehicles of any age, and older vehicles may have sparse or missing DVSA data. Where the vehicle data fields return null or empty strings, your logic should record that data was unavailable and route the event to a human review queue rather than clearing the vehicle automatically. Similarly, heavily modified vehicles may show a colour mismatch even with genuine plates. The cross-check is a probabilistic filter, not a definitive legal determination, and your system design should reflect that.
Triggering Alerts: Webhook Patterns for Real-Time Notification
A mismatch flag is only useful if it reaches a staff member in time to act before the vehicle clears the control point. For forecourts, that window is typically three to eight seconds between plate read and pump authorisation. For car park barriers, it is the two to four seconds the barrier takes to raise.
The recommended pattern is to post a webhook from your application server to a staff notification endpoint the moment a mismatch event is generated. Your mismatch event object should include the timestamp, the camera identifier, the recognised registration, the registered vehicle attributes, the confidence score, the mismatch fields that triggered the flag, and a reference to the captured image. A minimal payload might look like this:
{
"event": "plate_mismatch",
"timestamp": "2026-06-12T08:43:11Z",
"camera_id": "forecourt-entry-1",
"registration": "AB12XYZ",
"confidence": 94,
"registered_vehicle": {
"make": "FORD",
"model": "FOCUS",
"colour": "BLUE"
},
"observed_colour": "RED",
"mismatch_fields": ["colour"],
"image_ref": "frames/20260612_084311_entry1.jpg"
}
Route this payload to a screen alert at the payment desk, a push notification to a security tablet, and optionally to an audio alert. For unattended sites, route it to a remote monitoring centre. The key requirement is sub-second delivery from the point of mismatch detection to the point of human awareness.
Integration Patterns by Sector
Petrol forecourts: pump-hold logic
The standard integration approach is to read the plate as the vehicle pulls onto the forecourt, run the mismatch check, and hold pump authorisation in a pending state until the check resolves. If confidence is high and no mismatch is detected, release the pump as normal. If a mismatch is flagged, keep the pump locked and trigger a staff alert. The member of staff can then ask the driver to prepay, which either resolves the situation legitimately or causes the driver to leave before fuel is dispensed. Vars Technology's ANPR system, which provides staff with the make, model, and colour associated with each plate read, has demonstrated drive-off reductions of over 80% across its installed forecourt base.
Car parks: barrier hold
For car park entry barriers, the control window is tight but workable. On a mismatch, issue a barrier-hold command and display a message on the entry intercom screen asking the driver to speak with an operator. Log the event with the image reference. For unattended car parks, escalate to a remote monitoring operator via webhook. For attended sites, alert the booth directly.
Access control: deny and alert
For fleet depots, logistics yards, and secure facilities, a mismatch should result in an automatic deny at the gate alongside an immediate alert to the site security team. The gate log should capture the registration, the mismatch details, the timestamp, and the image reference. Do not raise the barrier pending manual override. The security officer reviews the alert and decides whether to grant access.
Fleet depot monitoring
Fleet operators can apply the same logic inversely. When a vehicle registered to the fleet presents a plate, the vehicle data response should match the known attributes of that specific asset. If the fleet record shows the asset as a white Sprinter and the vehicle data returns a different make or colour, the plate may have been transferred or cloned. Webhook the discrepancy to the fleet management system for investigation.
Reducing False Positives
No cross-check system is error-free. Colour perception varies with lighting, camera angle, and weather. DVSA records can be outdated for vehicles that have been resprayed or legitimately modified. To reduce the operational burden of false positives, apply a short grace window of five to ten seconds before a mismatch event escalates from a soft flag to a hard alert, allowing a second camera angle or a staff visual check to confirm. Maintain an operator review queue where borderline events, those with confidence between 75 and 89 or where only a single attribute mismatches, are presented for human decision rather than acted on automatically. Log all events, cleared and flagged alike, for audit purposes. Review false positive rates monthly and adjust synonym maps and thresholds accordingly.
UK GDPR Considerations
Processing vehicle registration marks and associated data through an ANPR system constitutes the processing of personal data under UK GDPR, because a registration mark can be linked to an identifiable individual through DVLA records. The ICO's guidance on video surveillance explicitly includes ANPR within its scope, and operators must identify an appropriate lawful basis before deployment.
For private sector operators such as forecourt operators, car park managers, and fleet operators, the most commonly applicable basis is legitimate interests under Article 6(1)(f) of UK GDPR. The ICO has indicated that preventing fraud and protecting property can constitute legitimate interests, but operators must complete a Legitimate Interests Assessment to demonstrate that those interests are not overridden by the rights and freedoms of individuals. That assessment should be documented before go-live.
A Data Protection Impact Assessment is also required where ANPR processing is likely to result in high risk to individuals, which the ICO's guidance confirms is the case for systematic surveillance of vehicles. The DPIA should address what data is collected, how long it is retained, who can access it, and how mismatch events are handled.
On retention, apply the principle of data minimisation. Clear vehicle images and plate strings for non-flagged vehicles after a short period, typically 14 to 30 days, in line with your stated purpose. Mismatch events that constitute potential evidence of fraud may be retained longer, but that retention period should be defined in your DPIA and privacy notice. Do not retain raw images of vehicles and occupants beyond what is necessary for your stated purpose. Publish a privacy notice at the point of data collection, whether on signage at the entry point or on the intercom display, telling drivers what data is captured and why.
Start Testing with Your Own Images
The cross-check approach described in this article requires only a camera feed, a small amount of application logic, and API access. The NPR API provides everything needed in a single call: the plate read, the confidence score, and the DVSA vehicle data, all returned together in a predictable JSON structure. The mismatch logic itself is a few dozen lines of code in any language.
The right place to start is with your own real images. Sign up for the free tier at nprapi.com, send a handful of entry camera frames with vehicle=true set, and inspect the responses. Check whether the returned make, model, and colour match what you can see in the images. That exercise alone will give you a clear sense of how accurate the data is for your specific camera positions, lighting conditions, and vehicle mix, and it will surface any synonym-mapping decisions you need to make before writing production logic. Full API documentation is available at nprapi.com/docs.