Ok, they way it is supposed to work
So the system is relatively secure, but the MERCHANT should have called the bank, not the customer, that is where it broke down. This system also allows for floor limits, where the merchant is willing to accept a certain level of risk and the POS device approves transactions for an amount less than a set limit. At the end of the day the POS device submits these transactions to the bank and if the cardholder does not have sufficient funds, the merchant loses out.
All these protocols have been in place for many years and dates from a time where communication between the POS and the bank was relatively expensive and slow. Dialling up for every transactions was not an option, so you would try to batch them together to achieve a lower cost per transaction.
This is a very high level explanation of the issues involved here, but should convey the general ideas.
Yes, the Apple Store managers and employees were idiots in this case
There are multiple CVV numbers assigned to a single card. The first is present on the magstripe. The second one is what we know as the security code and is printed, not embossed, on the signature panel on the back of the card. For chip cards and contactless cards you get other schemes such as this single use CVV numbers produced by the card.
Also, a card can only be blocked if it is presented to the reader for long enough to download a couple of scripts feom the issuing institution. A paypass card's offline wallet is fair game for anyone who picks up the card.
obviously it is much more complicated than the space/time available here
Bus error -- please leave by the rear door.