[yencabulator]

> 3) Discretely wave the device at your targets wallet

Phone payments generally require the phone to be unlocked.

Also, it's a credit card transaction: the user will complain later, attacker will get into legal trouble, and user will be refunded fully.