I like the camera idea. It would probably work just as well if the unauthorized user merely believed a picture was being taken; just have a pop-up message saying so before the transaction is finalized and skip the picture altogether.
Just saying that a confirmation email will be sent is likely not much less effective than a camera - in either case, the owner will find out that someone did something nasty.
Obviously that's preposterous, but my theory is that it might make some thief wary of stealing it.