Bolt Card & NFC Payments

Why can't a thief copy one tap's link and use it again later?

• The link is printed on the card and changes when the card is reported lost
• Each link carries a counter, and the card service accepts only a counter higher than the last one it saw
• Lightning invoices can only be paid once

A tap response says `maxWithdrawable: 5000000`. What is the most one payment can be?

• 5,000,000 sats
• 5,000 sats
• 50 sats