> Surely this is massively vulnerable to double spend attacks?

FeliCa uses mutual authentication with eventual bookkeeping and sync. I believe that there are some theoretical attacks on older cards but the terminals are regularly synchronized and get a ban list. In-practice, you’ll also be reported to the police, probably.