Yeah, this is a phishing attack replacing the terminal with a compromised one. The terminal used the PIN for three transactions: The original sign-in process,

Yeah, this is a phishing attack replacing the terminal with a compromised one. The terminal used the PIN for three transactions: The original sign-in process, the attacker's ID verification process for the bank, and a "Selbstauskunft" which essentially is an echo service that returns data read from the card back to the user. It's not a very performant process and needs to happen near real time.