It's not benign. An attacker could surf multiple IDs until they find one lowrr than their own and pay it instead. It's a viable attack. If the store disputes it, you can demonstrate that you paid and produce a receipt.