During an offline transaction, the Point-of-Sale has no internet connection, and so the payment terminal cannot verify if the client’s payment device has been revoked.
A malicious person can use a revoked bank card to perform unauthorized transactions.
How can this be prevented?
If the transaction is truly offline, also called store and forward in the retail space, then there is a lot of inherent risk the business is accepting. That is why almost all in person transactions involve an online authorization, which contacts the issuing bank to verify the transaction details.
I am not aware of any way to mitigate that risk in a true offline transaction scenario.
