I know the old mag stripe emulation was vulnerable, but EMV contactless shouldn’t hand out the card number and uses cryptographic signatures. You’d have to capture and play back a transaction (not randomly scan a card) and there are time stamps and transaction counters that would be wrong and the terminal ID wouldn’t match.