Expired credit cards revived by researchers to make unauthorized payments
Gaps in expiry checks could let dead plastic make purchases again
A team of researchers from the University of Massachusetts Amherst has discovered a way to revive expired contactless credit cards and make unauthorized payments. Their findings were presented at the USENIX Security 2026 conference. In their paper titled "Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments," authors Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza outline their attack on expired cards.
Credit card expiration dates aren't uniformly checked and enforced, creating vulnerabilities. The Europay, Mastercard, and Visa (EMV) payment process involves a card and a point-of-sale terminal communicating via NFC. The EMV contactless protocol is vulnerable because some data is sent in plaintext and later linked to cryptographic verification. This leakage allows for potential interference by malicious actors.
The researchers demonstrated they could exploit this weakness to revive expired contactless cards, enabling unauthorized payments. Visa contactless transactions are particularly susceptible due to a lack of effective integrity protection. Visa's kernel doesn't cryptographically bind the expiration date, allowing the POS terminal to evaluate processing restrictions independently of the card issuer's validation. Not all banks resisted the attack, as their handling of the transaction varied.
Despite notifying Visa of the issue in May 2025 and December 2025, the company and banks have not yet addressed the expiration date vulnerability. The researchers note that the trade-off between performance and security often leaves room for such vulnerabilities. Visa and the affected banks have not yet confirmed mitigation efforts.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
