Understanding a debit card reader through RFID
I believe contactless payment cards usually don't 'give out' the card number, CSC, expiry etc... Otherwise, that wouldn't make them much more secure than magnetic strips. 

AFAIK, contactless bank cards generally receive a cryptographic challenge from the bank, sign it and return the result to prove they are a real card.

I suspect what happened was that the RFID reader at the meeting you were at just read the unique identifier of the card and matched it to their database. I doubt they actually used anything else on the card since they likely don't have the means to decrypt or send challenges to it.

In other words, they probably simply read off the ID from an RFID card (not difficult, you can do it with smartphones and special apps) and sent this ID to their backend database to match the card with an account.

Doing it this way could be a potential security issue. It's next to impossible to emulate a bank card due to the fact that they use a challenge-response protocol to prove they're a real card. That's what makes it impossible to clone a contactless bank card.

However, it's quite easy to spoof or clone a card ID and can be done with essentially off-the-shelf equipment. For a transport system, it could mean random customers would get charged for fares they didn't take and people could free-ride.