The oyster travel cards in London are Mifare cards (not actually classic ones though) but the system was designed in a way to be resilient to attacks on the card.

When you tap the card on the reader the transaction happens locally with the card and the reader, this means that there is no latency and the system can continue to operate even if the central server goes down.

Every minute or so the machines sync with a central server and if at any point a machine saw a card with a balance or journey history that conflicted with the server copy then that card gets blacklisted and no machine will accept it any more. This means if you clone a card you can use it to start your journey but by the time you get to your destination you won't be able to get out.