It is illegal. They're counting on you to be too busy to sue them. That's why you only saw it in a train station. Ask your bank for a refund for the fraudulent transaction — you probably don't have enough evidence to prove it happened, but they'll still put the complaint on file.

Lawsuits and chargebacks are about the only pressure businesses have not to scam you.