Hmm, I would speculate it is something like this:
the card readers do not have any user unique information in them.
your debit card has a unique number (eg your bank account number), B - this is not secret and can be read visually from the car and is known by the bank.
your debit card card has a secret PIN, P, only known to you and the bank.
When you put the card in the reader and press identify the reader asks for your PIN and checks this against the card. If good it continues, if not it stops.
The card then uses some sort of encryption algorithm to generate a key (this is the number that is used to identify you to the bank when you login online). The key, I, is based on P, B and a current time T (but that would mean the card reader has to have a correctly set real time clock in it which seems unlikely).
Since the bank knows B and P it can decode I and find out the if I was created within the last 60 seconds.
There may be some other bank specific constants included in the encryption to make things a bit more secure.
But I don't think my speculation is correct - the need for a real time clock in the card reader seems a bit implausible - what happens if it drifts or if you take too long to change the battery? So this append is jjust a long winded way of saying I don't know.... :-(
No doubt there are IEEE etc standards for this - I will have a look.
