[beeflet]

Or you can extract the secrets from a smartcard using a variety of side-channels. But the juice is rarely worth the squeeze.

[rtpg]

Maybe you can, but I had the impression that it would be quite difficult given physically unclonable function-y stuff. Handwave-y and I have no clue if Suica-style payments use it but that was my impression.