Thanks.

In europe we use chip and pin, so a fake app could collect the pin directly. If someone was to harvest 30 cards with pin, could they then visit an atm directly? Perhaps I'm underestimating the difficulty of cloning cards. If that is possible, CVV2 would be unnecessary.

I hear your point about normal credit card terminals being available. As a european I wouldn't expect to see one on a stall by the side of a road though, and would normally be suspicious of anyone suggesting that they accept credit cards under these conditions.