Picking Up My Tab: Understanding and Mitigating Synchronized Token Lifting and Spending in Mobile Payment