I'm not sure about NFC specifically, but generally speaking all EMV cards have a private key that is 'signed' by the issuer.
More specifically, networks like VISA & Mastercard have root certificates, that they use to sign intermediate certificates to the issuing banks (e.g. Citibank), the issuing banks in turn use these certificates to sign card certificates that are unique for each card. Those certificates are in turn, tied to specific private keys embedded on the card.
When you insert your EMV (again not sure about NFC), the terminals validate these certificates against the root certificates they have pre-installed (not unlike how browsers validate TLS certs).
The 'trick' with EMV cards is that they never reveal their private key -- or at least they're designed to never reveal their private key. Only the certs are revealed.
Hence, when a terminal 'challenges' the card, only a valid card, signed by a valid issuer recognized by the network is allowed. You'll be unable to clone a card, because in order to do, you'll need the specific private key of the card, which the card is designed to never reveal.
Here's a great resource: