I would have guessed by some kind of challenge-response, but there seem to be many claims of 'passive' or 'broadcast-only' tags in the plates.
For example from http://www.e-plate.com/security.html:
[...] the active e-Plate tag is broadcast-only [...] The tag is tamperproof and cannot be used on another vehicle. Optional levels of encryption available. [...] e-Plate conforms to IS024535.
How does this work? Is it some time-based scheme? I can't find much information on IS024535 without paying for/ordering it.
Going further, are truly passive tags even possible for identification purposes? I can't imagine how those would work. I understand you can do challenge-response if the reader provides the energy to a passive tag, but is that possible at the distances involved in e.g. gantryway identification systems?