As weak as credit card numbers are as a security measure, the countermeasure defense is largely for credit-card issuers (and/or the processing networks) to monitor traffic very heavily for anything vaguely resembling fraudulent activity. Cardholders are largely protected by law (though merchants aren't).

The special sauce here is the location tracking. The system seems to assume that vendors are at a fixed location, but there's probably no reason a mobile device couldn't be constructed that functions as a PoS, and with hacked data/credentials, it could be used for tracking purposes. Say, with a number of confederates (or a good make-up job), charging stuff to your account while you're in the area. Or insert intelligence, criminal, stalker, jealous ex, etc., scenarios.

I'm increasingly in favor of cold hard cash for transactions rather than divulging my personal information in ever increasing amounts and rates.