Risky - is possible but you would basically be trusting the machine (or anyone else who scans the cup) not to steal all your money. You could limit the damage with a separate wallet I guess, but generally the payer should be the one initiating the transaction, actively and not passively. Maybe when M of N transactions are implemented, this type of thing would be more feasible?