Payments are interactive like credit cards. They require that either both parties are online or that there is some hosted bulletin board that will hold transactions data until you come online.
1. Alice has a secret called a credit card number.
2. To pay Bob she shares this secret with Bob.
3. Bob then contacts the credit card company and asks to transfer funds from Alice's account to Bob's account. This is authorized using the secret that Alice gave to Bob.
If Bob or some party acting on his behalf Alice can not receive this secret from Alice Bob can't get paid by Alice. As you point out if Alice gives the credit card secret to Bob, Bob can withdraw funds from Alice's account while she is offline. This is exactly the same in Mimblewibble. If you give a third party your Mimblewibble secret that third party would be granted the ability withdraw your funds while you are offline.
'normal', customer-present transactions are more involved. They involve Bob sending a set of transaction data to Alice's card, which the card then signs with an embedded private key, so that Bob can't just keep asking for more.
Unless you still use magnetic stripes. I'm looking at you USA...
