Let's keep in mind that they could already do this, relatively trivially, with far less technology, except you'd hand them your credit card first, instead of last.