Look at the FAQ: http://www.bumptechnologies.com/faq.phtml

Sounds like they're matching the timing and "type" or "intensity" of the bump using the accelerometers. Both phones send this data to their cloud server, the server is able to match the pair (unique timing of the bump, unique intensity, etc...), and then it transfers the contact data.

That makes sense; the odds of bumping at the same place, at the same time, and with similar enough motion vectors should be small enough to give uniqueness.

That said, every phone I've ever owned in Japan has a little IR port, and you can send your contact info across very easily, even between different carriers.