Re: What could possibly...?
Keep your debit card in an RFID blocking wallet or sleeve.
I like to demo to people the "Credit Card Reader" app which can pull off their card number and expiry date by just tapping an NFC phone against their card (or, in theory, from across the room) without them even knowing.
Sure, it's not every detail and not the same as performing a proper doink transcation, but it's enough. But put it in a sleeve / wallet with foil insert and you can't read the card at all.
The other app I like is "Passport Image Decoder". Worrying that such access is available passively without your knowledge, even if the most vital data is encrypted