Expired credit cards revived by researchers to make unauthorized payments

Researchers affiliated with the University of Massachusetts Amherst have found that you can get payments out of certain expired contactless credit cards, a process detailed at the recent USENIX Security 2026 conference. Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza describe their findings in a paper titled "Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments." Credit cards, the authors explain in their paper, have expiration dates, but the way these dates get checked and enforced isn't consistent. Thus, they were able to devise an attack that makes expired contactless cards appear to be valid to payment terminals. The Europay, Mastercard, and Visa (EMV) payment process involves a payment card (card or digital wallet in a phone) and a point-of-sale terminal communicating over a direct NFC channel, linked to a payment network (eg, Visa, Mastercard, Discover) that links the merchant to a bank and a card issuer. The transaction process relies on the EMV contactless protocol, which the authors say is fragile because the transaction flow is selectively authenticated - some of the data gets sent between the card and terminal in plaintext and is only later linked to cryptographic verification using Offline Data Authentication (ODA) and issuer-verified cryptograms. This leaves an opening for unwanted intermediary interference, which requires only the necessary knowledge and mobile phones acting as NFC proxies. And indeed, the researchers demonstrated that they could meddle in a way that revives expired contactless payment cards to make purchases. "Our results show that Visa contactless transactions are susceptible to man-in-the-middle tampering due to a lack of effective integrity protection," the authors state in their paper. What's more, they say, the wallet Card Transaction Qualifiers settings steer transactions toward online authorization checks instead of rejecting the transaction immediately. That shifts the enforcement burden to the card issuer where behavior varies and may rely on the POS terminal evaluation rather than conducting a full security check during transaction authorization. The EMV protocol is implemented in EMV kernels. American Express, Discover, Mastercard, and Visa each run their own kernels. Visa's kernel, the authors observe, is a bit more permissive than others. It doesn't bind the expiration date cryptographically. The Visa kernel allows the POS terminal to evaluate processing restrictions based on the Application Expiration Date, the authors explain. But the card issuer relies on an expiration date from a different data field in the online authorization request. These two dates should be cryptographically bound to each other, but they're not. This gap allowed the researchers to devise an attack using NFC proxy devices, as demonstrated in this video. Mastercard, American Express, and Discover configurations resisted the attack; Visa contactless cards did not. "The card gives the checkout terminal an expiry date to read," the authors explain in a summary of their work. "In the Visa contactless configuration we tested, that particular date was not covered by the card's digital signature. Someone positioned between the card and terminal could therefore alter what the terminal sees while leaving the card's normal security checks looking valid." Since Visa's approach kicks the authentication handling down the road to the bank involved, the attack's success depended on how the bank handled the transaction. Some of the banks tested succumbed, while others didn't. Raja Hasnain Anwar, lead author and a doctoral candidate at UMass Amherst, told The Register in an email that the reason Visa cards are affected by this attack has to do with the way different card manufacturers have different protocols for handling contactless transactions. "These protocols have most messages in common to ensure global acceptance on different types of terminals; however, each manufacturer has their design choices to make for additional mechanisms," he said. "Often, these design choices end up in a compromise to ensure backward compatibility with old POS terminals, and also to meet their performance criteria. "The security checks are in place, however, only a subset of these security mechanisms are invoked to make the transaction faster and smoother. There are other research studies that have shown issues with Mastercards as well. It comes down to the trade-off between performance and security, and often leaves room for this kind of vulnerability. No design is inherently bad." The authors say that they notified Visa of their findings in May 2025 and followed up in December 2025. Neither Visa nor the banks notified have confirmed that they've mitigated the expiration issue. Visa did not immediately respond to a request for comment. Let the dumpster dive for discarded cards begin. (R)