By reading the encrypted data off of two cards and testing thousands of potential site codes against both cards until the decoded data displays a predictable interval between the two, he can find the site code and use it to create more card keys with a magnetizing device.
For in-store scenarios either at the register or in the aisle, MasterPass supports the use of NFC, QR codes, tags, mobile devices used at points of sale or traditional plastic cards.
Thieves have been known to troll stores, writing down the redemption codes or registration numbers on cards, then registering the cards and draining them of cash.