Let's get more specific about your example, and say this is an online poker game. The server contains data that represents the center of the table (including the pot, the face-down deck and the "community" of cards), but the client software controls their "corner" of the table (the player's stash, their hand, and their decisions).
The assumption is that the client software is the same software released by the game's author, with no modifications of any kind, and so the client software has been made responsible for accurately tracking their bankroll and their hand; the server "deals" cards to the client, and much as the actual casino dealer would, "forgets" (or never knows) what card was dealt.
This is not a safe assumption; someone who can manipulate the client program, or even just the messages being sent to and from it, can choose their hand by modifying the messages about the cards the server has sent, and can similarly multiply their actual winnings (or even ignore losses by turning "you lose" into "you win $1000").
The solution is not to let the client software have anything approaching this level of control. The model to follow is that of a "dumb terminal"; treat the client software as nothing more than a really long cable connecting their keyboard and monitor to the server computer. The client knows nothing but what it's told by the server, and does nothing but relay the user's input to the server and vice versa. It has no "business logic" of its own, it just displays the game to the user.
Given such a model, manipulating communications does the attacker no good; the communications from the server and the numbers and cards on the screen can be changed to the attacker's heart's content, but any action based on the client's incorrect data is brought back to reality with a thud by the server. The client can't say "I raise 50 grand"; the server will simply reply "you only have $20 in your stack; try again". The client can't say "I'm Bob and I call"; the server, seeing that the request came over a secure session belonging to Bill, will say "No, you're Bill, sit down and shut up until Bob's actually taken his turn". Even replay attacks, where one client can listen to the secure conversation between another client and the server, and repeat the communication to perform any command contained in it, is very easily detected and ignored. Given enough of these harebrained communications, the server may eventually say "You're wasting my time; goodbye" and kick the client out of the game.
The downside, as was mentioned, is latency. The strategy in the ideal works for a poker game, where everyone acts in turn and so there's a lot of waiting anyway, and it's trivial for the server to keep track of everything going on at once. It doesn't work so well for a FPS or RTS, where interaction between all players must be real-time or darn close, and there's a lot of calculation of projectiles and bodies moving, flying, colliding, etc. It causes problems when latency is more than a few milliseconds (regardless of data rate); if everyone's got a 150ms ping to a game server, then everyone's seeing where everyone else was 300ms ago (at least) and if someone pulls the trigger when an opponent's head is in the crosshairs, the server thinks they're shooting at where the person actually was up to a half a second ago and says "you missed". That requires "lag leading" by the players, shooting in front of their targets by a distance based on their combined latency, even when the physics of the game dictate that bullet travel is instantaneous.
To compensate for this, the server necessarily gives up some control, and lets the clients say "I shot Bob in the head" when the player pulls the trigger while Bob's head is showing in their crosshairs on their screen. But, a player with a game mod that can strategically "ignore" incoming data about other players' positions can manipulate this amount of client trust to perform the "freeze frame" hack; turn off incoming datagrams, and everyone else freezes in place, allowing the attacker a nice easy headshot. If the server believes the client's claim, because nobody else claimed they shot that guy first, the other guy's dead even if his own client shows him safely out of the line of fire.
For this kind of thing, there really is no best answer; anywhere you place the control over making game-changing "referee"-type decisions, players will accuse others of cheating because they emptied a clip at the guy at point-blank range and the server says they hit air, or because the server said "Bill's dead, Bob shot him" two full seconds after Bill thought he'd cleared Bob's line of fire behind an obstacle.