Continuity mistake: The getaway car changes from a Peugeot Partner (1996-2003) to a Citroen C3 Picasso (2013-2017). (01:35:30 - 01:36:05)
Continuity mistake: When Nicky and Jess are seated at the small table, the amount of wine in his glass keeps changing up and down.
Plot hole: Nicky steals the EXR formula from Garriga's "server" by hacking it remotely within 48 hours. That's impossible. Garriga wouldn't carry his servers to race tracks. He needs only the fuel with which to race, not its formula. That means Nicky was left with penetrating air-gapped R&D servers inside Garriga's factory. This task is worth an entire film unto itself. It can't be done in 48 hours.
Plot hole: Garriga shows a small thumb-sized device, claiming it changes his password every 15 minutes, thus protecting his servers against brute-force attacks. In real life, remote servers are resilient to brute-force attacks because they restrict wrong guesses. Worse, changing the password every 15 minutes means Garriga would never know a password that can be reused indefinitely within 15 minutes! In real life, we use time-based one-time passwords (TOTP) and 2FA instead.
Continuity mistake: The amount of blood on Nicky's chest when he is shot by his dad changes between angles.
Answer: Absolutely. There are many people (especially people who work on high commissions and con men) who are well practiced in subtle cues with body language. The elaborate process they went through in the movie greatly increased the chances he would make such a pick, but there was no guarantee. However, it was constructed with personal knowledge of the target. Even more strange was the fact that a string of some of his reasonable bets went bad (the missed extra point, the pick of the card, etc). Had they all not gone bad, it would have disrupted his faked desperation to the multi-million dollar bet.