A device attached to an ordinary payment terminal can be nearly impossible for shoppers to spot, but authorities say it can give criminals access to sensitive card information in seconds.