Fair enough. I went through qr code of my previous metro ticket to see what info they encode. It is non standard so there were - some hashes - type of ticket, in my case single use, - time of issue, - valid upto time, approx 10hrs, approx journey time was only 30 min - ticket id - I could not directly see source/destination address, but it is my hunch that atleast the destination address is encoded

Now this one time ticket needs to generated before entering the metro station and the qr code is scanned at * both entry and exit*.

I think the entire system works on daily rotating ticket id validated using unique hashes where a ticket validity period is tracked. I think this should be enough to ensure non-reuse of same ticket.

The caveat is, I have always only bough one time ticket which is the only mode allowed in qr. For daily traveller's, they need to buy token/card which is NFC based.