All an attacker needs to do is set up a rogue PoS (Point of sale) terminal.
Only caution to be taken here, is that the amount need to be specified in advance.
Crucially, the payment amount must be requested in foreign currency, otherwise the 20 limit will kick in.
Heres a video of the lead author, Martin Emms, demonstrating the hack for theBBC.
Resource :Newcastle University Research
Read More
source: www.techworm.net