# Expired Credit Cards Revived for Unauthorized Payments Researchers successfully made payments with expired cards. - **Source:** [www.theregister.com - Articles (theregister.co.uk)](https://brifing.si/source/e6d4ec13-4d0e-407a-b96d-39609d76c3b1) - **Published:** 2026-08-18 - **Topic:** [Finance](https://brifing.si/c/finance) - **Original article:** - **On Brifing:** https://brifing.si/s/c08a659b-1e54-495f-bc2f-2c8bca8bbc4d ## Reviving Expired Cards Researchers from UMass Amherst developed an attack that makes expired contactless credit cards appear valid to payment terminals. This process was detailed at the USENIX Security 2026 conference. The researchers exploited inconsistencies in how card expiration dates are checked, revealing vulnerabilities in contactless payment systems. ## Weakness in the EMV Protocol The Europay, Mastercard, and Visa (EMV) payment process involves a payment card and POS terminal communicating over an NFC channel. However, the EMV contactless protocol is fragile due to selective authentication of transaction flows. Some data is sent unencrypted between the card and terminal, creating opportunities for man-in-the-middle attacks. ## The Issue with Visa Cards Researchers found that Visa contactless cards were vulnerable to this attack. Visa's kernel does not cryptographically bind the expiration date, causing terminals to misinterpret the card's expiration. Mastercard, American Express, and Discover configurations resisted the attack. ## Security Gaps at the Bank Level Visa's approach delegates authentication handling to the involved bank, making the attack's success dependent on the bank's transaction handling. Some tested banks succumbed, while others resisted, highlighting inconsistencies in security protocols among banks. ## The Role of Card Manufacturers Lead author Raja Hasnain Anwar attributed Visa cards' vulnerability to differing protocols among card manufacturers for handling contactless transactions. These protocols are designed for compatibility with older POS terminals and performance criteria but can introduce security flaws. ## Balancing Security and Performance Researchers noted that the trade-off between security and performance leads to such vulnerabilities. Only a subset of security mechanisms is invoked for faster, smoother transactions, which can also cause issues with other cards like Mastercard. ## Visa's Response Researchers notified Visa of their findings in May 2025 and followed up in December 2025. Neither Visa nor the informed banks confirmed resolving the expiration issue. Visa did not immediately respond to a request for comment, raising concerns about financial security. ## A Wake-Up Call for Financial Security This research highlights security flaws in contactless payment systems, serving as a warning for financial security. Card manufacturers and banks need to review and update their security protocols. Such vulnerabilities can risk consumers' financial information and lead to a loss of trust. ## Sources covering this story - https://www.theregister.com/security/2026/08/18/expired-credit-cards-revived-by-researchers-to-make-unauthorized-payments/5289229 — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._