[zeeZ]

Yeah, this is a phishing attack replacing the terminal with a compromised one.

The terminal used the PIN for three transactions: The original sign-in process, the attacker's ID verification process for the bank, and a "Selbstauskunft" which essentially is an echo service that returns data read from the card back to the user.

It's not a very performant process and needs to happen near real time.