Even encrypted tap-to-pay isn’t foolproof. Here’s how card data can still be stolen, and what to do if it happens to you.