An app is enough to access your data wirelessly. Your bank and credit cards as well as your identity and access cards are at risk - any card that has a contactless (RFID) chip.
The stolen data will be misused to obtain pecuniary benefits through your name. These include purchases or access to bank and insurance services. But there is more to it than that: because the criminal uses your identity, you may be discredited by the police, the authorities, your insurance company or your bank. Damage to your reputation is difficult to fix. In Europe and the US alone, the scope of direct asset crimes amounts to more than 50 billion euros per year.