But a fraudulent "merchant" could still install a custom machine at a busy spot, and charge a good percentage of all passing NFC payment cards. Do this in a tourist area or near airport / other terminal, targetting foreign cards, and there's a good chance the fraud detection does not kick in before the weekend is over, and you have $20 x 50,000 "customers" x 2 days = 2 million in bank, converted immediately to bitcoin or similar and laundered before banks open on Monday.

Why, yes, I've been the receiving end of a similar scam. It was Visa Electron and PIN-less purchases, then a new opt-out feature. The math was more like 5 customers, but 10,000 euro limit. (No, I did not lose that, or even close, by being lucky.)