The key has to be exchanged beforehand. Usually this happens during system setup somehow and often completely off-line.
The ID is not used to prevent cloning. It is required for the reader to select the correct key for talking to this card.
It seems they have a TRNG.
