You just plug in, no card. The car identifies itself. It needs an internet connection to report the usage so it can be charged to the correct account. Gas stations obviously need a network connection of some kind too for card swipes to work. Otherwise you'd have to fall back to cash or manually writing down card numbers (is that even allowed anymore?) Almost all Superchargers are unmanned so no cash.
EMV (chip/contactless) credit cards are capable of working without an internet connection, including PIN or device-based verification. Transactions get stored/batched on the payment terminal until the connection is available again.
EV chargers often still require internet, however, as payment is via app or their own RFID card/dongle. Putting credit card readers directly on the chargers is a relatively recent (and not yet universal) improvement.
Another reason for internet is so that chargers can report their availability status. In-car navigation or charging apps can direct you to locations with available chargers, avoiding ones that are fully occupied or out of service.
There's no way to verify the balance offline. But, generally speaking, the offline mode is only used if there's a network/connectivity failure, and there's generally no way for a fraudster to know in advance if that's going to happen.
The acquirer (ie: the merchant's bank) accepts liability in the case of fraudulent transactions. There are limits on offline transaction values, and merchants that have high fraud risk may not allow it at all.
That may be theoretically possible but I very much doubt any retailers have that set up to work properly. Around here the gas stations still verify your ZIP code. Superchargers could also store transactions in theory but I doubt it actually works there either.
It certainly happens, very occasionally, here in the UK. You try to pay something with contactless but there's a long processing delay. The terminal will then time out and ask you to insert the card and enter PIN, and you will get something strange printed on the receipt like "CVM: offline PIN". You may then see the transaction pop up in your notifications a few hours later, or early the next morning.
Also, some merchants do offline or semi-offline transactions as a matter of course. London Buses, for example, accept contactless payments via bank card. But the transaction must be processed very quickly and the mobile data connection is not entirely reliable - the bus could be in a tunnel or a coverage black spot. So what really happens is the transactions are batched and processed at the end of the day (this also allows them to do some post-processing for multiple-journey discounts, daily price caps, etc).
Someone like London Buses isn't overly concerned about fraud because the transaction values are low. But they do have a way to blacklist cards numbers that are known to be bad.
There are only half million Teslas so you can just distribute the VIN numbers of all of them with a single bit flag saying whether they are eligible for free charging and another bit saying that they have an account in good order. Twenty bytes per car should do it, say 10 MB of storage to hold enough information to say which cars are allowed to charge even if the network is down.
Mind you in three years of owning and driving (70k km) my Model S I have never encountered a Supercharger station that was entirely out of order, just a few heavily used ones that have one or two stalls often not working.
