RFID scanning of cards? One of my relatives visited the Macy's at South Shore Plaza but didn't buy anything. An email from Macy's showed up hours later saying something like "Sorry we didn't have what you were looking for today. Please come again."
Theres definitely more to this than being written. Geo-fencing is pretty common for tradeshows and events, and even to a lesser degree places like retailers. But theres a zero % chance retailers are scanning unsuspecting customers cards in their wallet or purses.
Without all the info, I would assume your family member has clicked on macys email links in the past and been cookied. I also assume they're a previous Macys customer. From there, it would be easy for a marketing team to setup a geofence workflow in a system like Eloqua or, more likely as its B2C, Responsys. Something like: "1 hour after lead leaves geofence, check for new purchase."
If they have new purchases associated with their account - via Macys card/account, if they gave their email during a previous purchase, or less likely, with a CC associated with the account record - they'd get a "thanks for shopping at Macys". If they didnt, they get "sorry you couldnt find what you were looking for."
Either way, they arent scanning people's cards/wallets/purses as they enter or exit a store.
But none of that is really relevant to this discussion. POS information from a beer vendor or pizza vendor would be stored in a completely different system than the one used for marketing/sales KPIs (like season ticket holder vs 1 off visitor). Companies jump through a lot of hoops to ensure personal information like credit card info, social security numbers, health info, etc stay isolated in a different data pool. Theres also way too much room for error to take any stock into that information even if they decided to. As stated above, people have cash, mobile payment methods, different banks/ATM cards, different credit cards, etc. Trying to isolate and associate all that data at a scale of 45k per event would be a fool's errand and riddled with caveats. Nobody would take those metrics seriously.