{
  "id": 1804669,
  "title": "Expired credit cards revived by researchers to make unauthorized payments",
  "url": "https://urgent.news/2026/08/18/expired-credit-cards-revived-by-researchers-to-make-unauthorized",
  "topic": "science",
  "section": "Science",
  "published": "2026-08-18T20:20:28.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/08/18/expired-credit-cards-revived-by-researchers-to-make-unauthorized-payments/5289229"
  },
  "original_language": "en",
  "account": "A team of researchers from the University of Massachusetts Amherst has discovered a way to revive expired contactless credit cards and make unauthorized payments. Their findings were presented at the USENIX Security 2026 conference. In their paper titled \"Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments,\" authors Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza outline their attack on expired cards.\n\nCredit card expiration dates aren't uniformly checked and enforced, creating vulnerabilities. The Europay, Mastercard, and Visa (EMV) payment process involves a card and a point-of-sale terminal communicating via NFC. The EMV contactless protocol is vulnerable because some data is sent in plaintext and later linked to cryptographic verification. This leakage allows for potential interference by malicious actors.\n\nThe researchers demonstrated they could exploit this weakness to revive expired contactless cards, enabling unauthorized payments. Visa contactless transactions are particularly susceptible due to a lack of effective integrity protection. Visa's kernel doesn't cryptographically bind the expiration date, allowing the POS terminal to evaluate processing restrictions independently of the card issuer's validation. Not all banks resisted the attack, as their handling of the transaction varied.\n\nDespite notifying Visa of the issue in May 2025 and December 2025, the company and banks have not yet addressed the expiration date vulnerability. The researchers note that the trade-off between performance and security often leaves room for such vulnerabilities. Visa and the affected banks have not yet confirmed mitigation efforts.",
  "summary": "Gaps in expiry checks could let dead plastic make purchases again",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register",
        "title": "Expired credit cards revived by researchers to make unauthorized payments",
        "url": "https://urgent.news/2026/08/18/expired-credit-cards-revived-by-researchers-to-make-unauthorized-1809493",
        "published": "2026-08-18T20:20:28.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}