Microsoft uses something similar for their on-campus cafeterias. All Microsoft employees are issued a RFID card with a chip that functions as a door access card, visual ID (it has your photo/name/employee number on it), smartcard for 2FA (this is being phased out in favor of TPM-based device registration), and cafeteria payment system. You can elect to have some percentage of your paycheck automatically loaded on the…
I guess each "Eagle Cash" terminal has a certificate, and whenever you credit/debit the card, the terminal adds/subtracts the amount on the card, signs the new balance with the certificate, and then this can be verified at any other terminal.
In other words, you can't modify the balance on the card unless you have the secret certificate, which is only present on the authorized terminals. If you try to modify it yourself, you can't do it, because no other terminal would accept the card unless the balance was cryptographically signed with the cert.
That's my guess for how this works, at least. I wonder if each terminal has a unique cert that can be revoked if it is compromised.