In Turkey when the contactless payments became ubiquitous one concern / urban myth was that people were using actual pos devices in public transport to lift money from wallets at back pockets and stuff. I guess that would work but that kind of fraud gets shut down pretty fast.

Relaying the thing seems like a workable thing but the timeout aspect is interesting. I wonder how fast can a short direct radio link would operate. Say someone inside an Apple store relays a card from another shopper while the accomplice checks out. In the line of sight of victim?