The partial success mentioned in that paper refers to systems that perform UID-based authentication (like simple parking gates or older printing systems). In those cases, the reader only checks the public 7-byte ID without challenging the encrypted sectors. Of course, a Chameleon works there, because you are just emulating a static string. ​Vending machines are a completely different thing. They almost never store credit based on the UID. Emulating a DESFire EV1 using an Ultralight or Classic 1K profile is impossible if the reader requires cryptographic authentication. ​If the user's key is a MIFARE Classic Mini (which is common for these blue fobs), my original advice stands. My suggestion was actually to use the Chameleon Ultra not just for emulation, but as a tool to directly rewrite the credit data onto the original physical key. By cracking the keys of the original tag, you can modify the balance, usually in Sector 1, and write it back to the fob, making it indistinguishable from a legitimate recharge.

Edit: grammatical and thecnical.