in this attack the card reader is compromised. the attackers can make it display whatever they want it to.

Edit: For this to work the card itself would have to have it's own display. Another commenter suggested e-ink.