Sorry, but as someone who is involved with the development of contactless payment terminals, this just isn't a practical attack.
The phase where the relaying is supposed to happen (between the terminal sending its actual challenge and receiving the response) already employs a very short timeout (a millisecond or less, definitely not anywhere near a network round-trip to, well, anywhere).
There is a 'card selection' phase that may take (much) longer, as well as various retries, but the key bits (pun intended) of the exchange are only valid in that very short window.
Also, upwards of 80% of all point-of-sale transactions in some northern-European countries are NFC these days, and if any of this had truly any large-scale applicability, people would definitely have noticed...
The phase where the relaying is supposed to happen (between the terminal sending its actual challenge and receiving the response) already employs a very short timeout (a millisecond or less, definitely not anywhere near a network round-trip to, well, anywhere).
There is a 'card selection' phase that may take (much) longer, as well as various retries, but the key bits (pun intended) of the exchange are only valid in that very short window.
Also, upwards of 80% of all point-of-sale transactions in some northern-European countries are NFC these days, and if any of this had truly any large-scale applicability, people would definitely have noticed...