Unlimited fares should be extra easy with a QR code. Just put a signed expiration date.

If course duplication is probably a bigger risk for these tickets as they case be simply locked to one use server side.