I assume the protocol is designed such that you cannot record a response and then replay it later. If that's true (and I could be way too optimistic here) then an attack like that would require two confederates and some communications hardware, with one guy on the street scanning people's cards at the exact same time as the other guy presents his end of the equipment to the local point of sale. This is all doable, but it doesn't scale too well.