Every vending machine can verify signatures using a CA certificate. Charging stations and a vending machines also have a signing key signed by that central certificate. Whatever is written on the card is signed by whoever wrote it.
Charging a card goes like this: - Read everything from the card (data + signature) - Verify signature + expiration dates, etc - Extract amount on card - Decrement said amount - Write new amount to card - Sign data on card using local signing key
It's a bit more complicated than that, but you get the idea. In some systems the logs of all transactions are reconciled asynchronously (if and when internet connection is available) so if a card is cloned it can eventually be detected and blocked.
That's a great answer though, thanks for writing it up!
I'd expect that there would be a strong incentive to have the cards require network access to verify balances or else some enterprising hackers could potentially reverse engineer the process to add additional funds to the card.