It's really not that big of an issue when the spends are reasonable sized (e.g. public transport). You don't need to prevent literally all fraud, just enough that it becomes an acceptable cost of doing business. Fielding customer complaints because they couldn't ride due to an offline reader isn't free either.