A thin client is a program which connects to the Bitcoin peer-to-peer (P2P) network but which doesn't fully validate transactions or blocks. That is, it's a client to the full nodes on the network.

Most thin clients use the Simplified Payment Validation (SPV) method to verify that confirmed transactions are part of a block. To do this, they connect to a full node on the P2P network and send it a filter (called a Bloom filter) that will match any transactions affecting the client's wallet. When a new block is created, the client requests a special lightweight version of that block called a Merkle block.

The merkle block includes a block header, a relatively small number of hashes, a list of one-bit flags, and a transaction count. Using this information---often less than 1 KB of data---the client can build a partial Merkle tree to the block header as illustrated below. If the hash of the root node of the partial Merkle tree equals the hash of merkle root in the block header, the SPV client has cryptographic proof that the transaction was included in that block. If that block then gets 6 confirmations at the current network difficulty, then the client has extremely strong proof that the transaction was valid and is accepted by the entire network.

(Image taken from MIT-licensed Bitcoin.org developer documentation. I'm also the author of that image.)

The only major downside of the SPV method is that full nodes can simply not tell the thin clients about transactions, making it look like the client hasn't received bitcoins or that a transaction the client broadcast earlier hasn't confirmed.