There are different types of authentications for cards. Years ago the old mag stripe cards (still in use in the USA) had only "Static Data Authentication" (SDA), which was a fixed, unchanging number embedded in the mag stripe, similar to the CVV2 printed on the back of the card. The data breaches that have rampaged across America in the last few years have been due to exactly the problem you identified; that is the malware in the payment terminal makes a copy of the data and sends it to the hacker. SDA cannot defend against the type of copying you describe.
A more modern type of authentication is called Dynamic Data Authentication (DDA). It takes advantage of the fact that the card data is delivered by a computer chip, and is not just a stream of fixed data. The computer chip runs an algorithm to generate the DDA number; this algorithm uses a rolling code. This DDA then takes the place of the old SDA. During authorization, the bank notes the rolling code value used to generate that DDA and invalidates any older DDAs in order to prevent a replay attack using any earlier DDA codes.
That means that if a terminal makes a copy of a DDA card's data verbatim, including the DDA, the bank will still reject it on future transactions because that DDA has already been used.
Finally, EMV supports the Combined DDA (CDA) method, which is a cryptographic operation based on various pieces of data available in the transaction, including the transaction number, amount, terminal ID, an internal counter, a terminal-generated random number, and a secret key stored there by the issuing bank. The algorithm produces a cryptogram that can only be recalculated by someone who knows all of those components; since they include the secret key, only the bank or the card's chip could reproduce them.
(There was an attack possible when the terminal's generated random numbers weren't truly random; changes to the EMV spec in revision 4.3 addressed that.)
Note that some older EMV chips may still use SDA because it's still supported by the protocols. But if the authorization data is skimmed or copied, the bank who issued the chip with SDA has to pay for the fraud because they used known insecure technology.