Basically each time the card is used the reader and card exchange a challenge/response in the form of pseudo random data encrypted probably with AES or triple des and because both the card and the reader know the secret key they can exchange the pseudo random data and because they both use the same pseudo random number generator they know what the next number in the seqence should be.
Only cards with the same secret key as the reader can generate the correct response to the readers challenge. Its protected from a replay attack where someone simply records the data transfers and plays them back at a later time with the use of timestamps embedded in the encrypted data.