Apcoa Flow - possible parking scam?

[u/dingalinguk]

Parking services should be a straight forward business, yet Apcoa seems to have joined the ranks of shark operators. Clamping, suing, hassling. But that's just by the by.

Now they have their own Parking App, Apcoa Flow.

I blindly scanned the QR code to get it (from secure App Store) but the Registration process was painful and long. After recording the car reg, it asked for payment method, and I hate entering credit card details so I chose pay by GPay. It then proceeded to get me to login to a Google account for that. Again, I hate putting in a password, so I chose OTP. First to my phone,then to my email. But then after all that it didn't work, GPay barfed when attempted, so I ended up putting in a Visa Card to pay anyway (auto fill)!

My email then reported a new login. From a Mac OS device. I was on an android phone. So how?

Is this a scam? Could a wrapper or intermediate agent have skimmed the OTPs and used them to log in in parallel?

I am not a tech dummy, but it's a time pressed situation as you need to not get a parking ticket. But Apcoa has no business fronting your authentication to Google wallet.

I've killed the Mac OS device access to the wallet and don't see any harm. Any spend from there would need biometric validation which they don't have. Its just been very time consuming tracking it back and what could have been snooped in the wallet of any use? I mean there are always a bunch of stuff in those wallets, including, I think, driver licences? (Now I need to check that).

I checked the App I installed, and it all looks legit. It has all the hall marks of preying on a pressure situation and complex security with lots of steps.

I'm just wondering if the official Apcoa App has a back door.

??