How SAM modules secure transactions?
In the Smart Card industry, it is often used a technique called diversification: individual Smart Cards get a serial number $S$, and a device-unique secret key $K_S$ computed from a Master Key $K$, and $S$, using a (typically: non-entropy-stretching) Key Derivation Function. For example, $K_S=\operatorname{AES-ENC}(K,S)$ where the first parameter of $\operatorname{AES-ENC}$ is the key; or perhaps, $K_S=\operatorname{HMAC-SHA-256}(K,S)$. Injection of $K_S$ in Smart Cards, and injection of $K$ in SAMs, is done in secure conditions (production line of a card manufacturer).

A SAM contains $K$, thus is able to internally recompute $K_S$ of any Smart Card that it must interact with, from its (alleged) serial number $S$, which is usually freely readable from the Smart Card. The SAM and the Smart Card (if it is genuine) will thus share the secret key $K_S$, and then there are plethora of protocols to perform mutual authentication and establish a secure link.