At least they're just storing a primary key on the RFID tag, as opposed to the actual data. The Boston subway actually stored value on the cards, and some MIT kids exploited that this summer -- (http://www-tech.mit.edu/V128/N30/subway/Defcon_Presentation....).
