Assuming he stole it would still not deter the fact that the only way to obtain the original pass would have been to either do the first premise or the other. Also, we have been given no data to assume that there have been any instances of lost passes by other individuals. Maybe the passes contain personal information that wouldn't be linked to the perpetrator. Also, it says in the passage that the pass can be obtained in the app meaning the original owner would still have access to the pass and we can assume the owner would report the stolen physical item if there was such a thing but given that we know the only way to obtain a pass is through an app, there is nothing to support the idea of a lost physical item.