A thief could potentially have used a cancelled contactless card without the retailer or bank realising. Fraudulent offline payments should be stopped by a Pin request, assuming of course the ...