I can verify this is possible.

Interesting! A bit or research in this area may literally pay :)

you can do this but the bank will know and the police will show up.

I don't mean to endorse such behavior, but the folks who used a loophole after stealing my ATM card details from a data breach never got caught using a variety of ApplePay based variants of this attack (now fixed, btw).

In general folks who get serious about it never get caught. Which is why folks who give a damn about the world don't talk about specifics on public forums.