> if you've compromised a merchant deeply

Then you could just complete a normal transaction on their website and introduce your account in to their system that way, no real need for a compromised terminal?