It is likely touchngo credit is not stored in your card.
Only the card serial/pin is stored in the card.
In this case, they just need to build a card reader in lrt booth/toll booth.

If the credit is stored in the card, then they need to build a card reader/writer in lrt booth/toll booth, why spend more while they can save?

If you tamper with the card, they can just make your card tidak sah in your next transaction, then you need to go to touch n go center and submit your card for investigation, then they will know what you did and you will not get a refund.

no matter how, it is a lose lose situation.

so how you tamper the amount?

1. Read the second paragraph. Which is my assumption, and gave the same meaning of 'sync'. When you do transaction, I doubt TnG terminals will directly connected to the server->check balance->then do transaction if balance is valid. Thus it's offline and transaction is allowed based on the balance stored in the card. End of the day, when clearance is done, the balance of the card might be calculated. Each transaction values will be deducted from the most recent top up value, a.k.a synchronizing. Thus, if final balance is negative, the card have invalid balance, meaning the data might have been altered by the user. I developed an e-payment system that uses smart card before. So I know how slow it would be if the transaction is online.
2. This one I know. I use this all the time when I top up my MyKad.
3. This one also I know. I did mention about APDU right? APDU is the way terminals/card reader communicate with the chip on the smart card.

May be.

I bought an RM 300 credit card for RM 100 before long time ago, used it only 2 times before it was blocked for further transaction.
Went to TnG centre and check, they said the card is faulty, they can issue a refund if I can find out the owner. (not sure if they will really issue a refund or report police instead)