This reminds me of patio11’s assertion that the optimal amount of fraud in a system is not 0 because the marginal price of reducing fraud to 0 is far higher than the amount lost to the hardest to eliminate fraud.

The key is to make sure that the costs of eliminating theft are internalized. So as long as the train company reimburses everyone fully then I would imagine they will quickly figure out what the correct level of security is.