With an API that just runs unauthenticated, I’m unsure what any of these suggestions is supposed to improve here.

I’ve always found this very weird in the US. In Europe they come to the table, we tap the scanner and if it’s over a certain threshold, you need to enter your PIN. Most larger transactions require your PIN these days.

These cowards come in heavily armed a dozen at once. Even if you manage to shoot one, you’re as good as dead when the others start firing back.