The vulnerability probably wasn't in the cards. That is, the cheater could not read the card RFIDs directly. It is more likely that he has been able to access,

The vulnerability probably wasn't in the cards. That is, the cheater could not read the card RFIDs directly. It is more likely that he has been able to access, in real-time, the system reading the cards and storing the card values.