If you only want card details for online/card-not-present transactions then getting them via malware is easier and even less risk of getting caught.
It's really a balancing act between the three. The more zoomed the lens, the bigger the lens elements need to be to maintain the same aperture ratio. That's why a 600mm f4 is absolutely massive compared to a 50mm f4 lens.
For something like this application though, the quality of the sensor doesn't need to be too high, you don't really that high of a shutter speed, nor do you need to worry about image noise. There's always light on at the pump, so you can easily calibrate for night time, if needed just bring a light meter (or use an app) to the spot at night and check.