Most still don’t use mobile pay terminals. You give your card to a waiter and he or she disappears with it. Taking the photo of a card with CVV code is trivial. A whole lot easier than breaking into a server.Many restaurants offer tap to pay at the table these days. However, most restaurants don’t store you cc. information on their servers.
Same with small offices that pay **** wages to administrative staff and have high turnover. Accessing customers’ billing info is too easy. And there’s a slim chance that the police or the issuing bank’s fraud investigation team will spend the resources required to track the source of leak to that specific office and that specific employee who no longer works there, let alone build any prosecutable evidence that is not entirely circumstantial.