Tap/swipe in with one card, tap swipe out with the same card but don't actually leave. Hand the card to your buddy who swipes in and enters with you. Do the same thing on exit. You can then have as many people as you want travel for the cost of one.

A technological countermeasure would be to make it like an airlock - you have to get through the first set of gates (which won't let you return), and then have to tap your card to pass the second gate to finally exit.

Obviously, this is not a realistic solution - building new exit gates is simply not worth it.

Practically, such behavior if done repeatedly can be detected as an anomaly in card usage patterns, and a human reviewer can surely figure out what you're doing.

Blocking exit gates are a safety issue even under what would otherwise be normal operating conditions (e.g., no declared threat).

Absent some sort of ranged tag detection (e.g., NFC or RFID), exit determination is exceedingly difficult. I'd argue that NFC/RFID operating beyond a few cm range are themselves a major infosec threat and privacy invasion.

You can trivially jump the fare gates. BART fares are enforced by inspectors checking proof-of-payment; if your group was stopped they’d be caught out by only having one card with an active trip.