Expired Credit Cards Revived for Unauthorized Payments
Researchers successfully made payments with expired cards.
1Reviving Expired Cards
Researchers from UMass Amherst developed an attack that makes expired contactless credit cards appear valid to payment terminals. This process was detailed at the USENIX Security 2026 conference. The researchers exploited inconsistencies in how card expiration dates are checked, revealing vulnerabilities in contactless payment systems.
2Weakness in the EMV Protocol
The Europay, Mastercard, and Visa (EMV) payment process involves a payment card and POS terminal communicating over an NFC channel. However, the EMV contactless protocol is fragile due to selective authentication of transaction flows. Some data is sent unencrypted between the card and terminal, creating opportunities for man-in-the-middle attacks.
3The Issue with Visa Cards
Researchers found that Visa contactless cards were vulnerable to this attack. Visa's kernel does not cryptographically bind the expiration date, causing terminals to misinterpret the card's expiration. Mastercard, American Express, and Discover configurations resisted the attack.
4Security Gaps at the Bank Level
Visa's approach delegates authentication handling to the involved bank, making the attack's success dependent on the bank's transaction handling. Some tested banks succumbed, while others resisted, highlighting inconsistencies in security protocols among banks.
5The Role of Card Manufacturers
Lead author Raja Hasnain Anwar attributed Visa cards' vulnerability to differing protocols among card manufacturers for handling contactless transactions. These protocols are designed for compatibility with older POS terminals and performance criteria but can introduce security flaws.
6Balancing Security and Performance
Researchers noted that the trade-off between security and performance leads to such vulnerabilities. Only a subset of security mechanisms is invoked for faster, smoother transactions, which can also cause issues with other cards like Mastercard.
7Visa's Response
Researchers notified Visa of their findings in May 2025 and followed up in December 2025. Neither Visa nor the informed banks confirmed resolving the expiration issue. Visa did not immediately respond to a request for comment, raising concerns about financial security.
8A Wake-Up Call for Financial Security
This research highlights security flaws in contactless payment systems, serving as a warning for financial security. Card manufacturers and banks need to review and update their security protocols. Such vulnerabilities can risk consumers' financial information and lead to a loss of trust.