Expired Visa Contactless Cards Revived by Researchers for Unauthorized Payments
Researchers have demonstrated a method to exploit a flaw in Visa's contactless payment protocol, allowing expired cards to be used for unauthorized transactions.
Researchers from the University of Massachusetts Amherst have uncovered a significant vulnerability in Visa's contactless payment system that allows expired credit cards to be used for unauthorized purchases. The findings, presented at the USENIX Security 2026 conference, detail how a lack of cryptographic binding between the expiration date presented to a payment terminal and the date used for online authorization can be exploited.
The attack leverages NFC proxy devices to intercept and alter transaction data in real-time. The EMV contactless protocol, while designed for secure transactions, has certain data fields transmitted in plaintext. This allows for man-in-the-middle attacks where an intermediary can modify information before it reaches the payment network for authorization. The researchers specifically targeted Visa contactless cards due to their kernel implementation, which they found to be more permissive than those of other major card networks.
According to the paper, titled "Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments," the vulnerability stems from how Visa's kernel handles expiration dates. While the payment terminal receives one expiration date, the card issuer relies on a different date during the online authorization process. Crucially, these two dates are not cryptographically linked in Visa's implementation. This discrepancy creates an opening for attackers to present an expired card to a terminal, which then initiates a transaction that bypasses the intended expiration check.
When a Visa contactless card is presented to a compromised terminal, the attacker's NFC proxy can alter the expiration date presented to the terminal. The terminal then forwards the transaction for authorization. If the issuing bank's authorization system is also susceptible to this manipulation, the transaction can be approved despite the card being expired. This contrasts with implementations from Mastercard, American Express, and Discover, which reportedly resisted similar tampering attempts.
The researchers noted that the effectiveness of the attack also depends on the card issuer's backend systems. Some banks, when presented with the altered transaction data, still proceeded with authorization, while others correctly identified and rejected the fraudulent transaction. This highlights a broader issue within the payment ecosystem where security enforcement is not uniformly applied across all participants.
Lead author Raja Hasnain Anwar explained that the differences in vulnerability are due to varying protocols and design choices made by card manufacturers. He stated that these choices often involve trade-offs between security and performance, particularly to ensure backward compatibility with older point-of-sale terminals. In the case of Visa, the security checks are sometimes deferred to the authorization phase, creating the window for exploitation.
The research team disclosed their findings to Visa in May 2025, with a follow-up in December 2025. As of the publication of the article, neither Visa nor the affected banks had confirmed implementing a fix for the expiration date vulnerability. Visa did not immediately respond to a request for comment regarding the research.
This discovery raises concerns about the security of contactless payment systems and the potential for attackers to exploit seemingly minor implementation details to conduct fraudulent transactions. It underscores the ongoing challenge of maintaining robust security in rapidly evolving payment technologies.