Researchers revive expired Visa cards to make payments
Researchers affiliated with the University of Massachusetts Amherst, Raja Hasnain Anwar, Gerard DeCunha and Muhammad Taqi Raza, found that certain expired contactless credit cards can still be used to pay, and presented the work at USENIX Security 2026 in a paper titled "Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments." The EMV contactless protocol used by card, terminal and payment network selectively authenticates the transaction: part of the data passes between card and terminal in plaintext before being tied to cryptographic checks such as Offline Data Authentication and issuer-verified cryptograms. In Visa's kernel specifically, the researchers found that the Application Expiration Date the terminal checks and the expiration date the card issuer relies on during online authorization come from different data fields that are not cryptographically bound to each other. Using ordinary mobile phones as NFC proxies to sit between card and terminal, as shown in a demonstration video, they could alter what the terminal saw and make an expired card pass as valid. "Our results show that Visa contactless transactions are susceptible to man-in-the-middle tampering due to a lack of effective integrity protection," the authors wrote in their paper. Mastercard, American Express and Discover configurations resisted the same attack; Visa contactless cards did not. Because Visa pushes the authentication decision to the card-issuing bank, the outcome varied by bank: some of the banks tested succumbed to the attack and others did not, though the article does not name which. Lead author Raja Hasnain Anwar told The Register that Visa's exposure comes from design choices manufacturers make on top of a shared protocol core, often trading some security checks for speed and compatibility with older point-of-sale terminals, and noted that other research has found separate issues with Mastercard as well. The researchers notified Visa of the findings in May 2025 and followed up in December 2025; as of publication, neither Visa nor the banks notified had confirmed the expiration gap was fixed, and Visa did not respond to The Register's request for comment.
Key facts
- UMass Amherst researchers (Anwar, DeCunha, Raza) showed expired contactless credit cards can still authorize payments, presenting at USENIX Security 2026
- The flaw is specific to Visa's EMV kernel: the terminal's Application Expiration Date and the issuer's expiration data field are not cryptographically bound
- An NFC man-in-the-middle attack using ordinary phones let the researchers make expired Visa cards appear valid to terminals
- Mastercard, American Express and Discover configurations resisted the same attack in testing; Visa cards did not, and results varied by bank
- Visa was notified in May 2025 and again in December 2025 but has not confirmed a fix, and did not respond to The Register's request for comment
Why it matters
Payment security depends on every check in the chain actually being enforced, not just present. Here the expiration date, the simplest possible check on a card, turns out to be readable and alterable in transit because Visa's contactless implementation never cryptographically ties the terminal-facing expiry field to the one the issuer checks. That is a protocol-level gap, not a one-off bug in a single bank's system, and it went unresolved for well over a year after Visa was told.
Who it affects
Anyone paying with a Visa contactless card or a digital wallet using Visa's kernel is potentially exposed, since the weakness sits in the card-to-terminal protocol itself rather than in one issuer's software. Cardholders whose expired Visa cards are still physically intact, and the banks that issue Visa cards, are the parties directly implicated; Mastercard, American Express and Discover users are not, since those kernels resisted the same attack in the researchers' tests.
How to use it
There is no consumer action here beyond ordinary card hygiene: destroy expired cards rather than discarding them intact, since the research shows an expired card is not automatically inert. The paper and the demonstration video are aimed at the payments industry, banks and Visa, who are the ones positioned to close the gap by cryptographically binding the two expiration fields.
How solid is it
This is peer-reviewed academic work presented at USENIX Security 2026, a top venue for security research, with a named paper, three named authors and a working demonstration using NFC proxy hardware. The Register also got direct comment from the lead author. The one limitation the article itself flags is scope: it does not say how many banks were tested or name which ones succumbed, so the real-world hit rate across Visa-issuing banks is not quantified.
Risks and caveats
The article gives no financial-impact figures, no count of vulnerable banks, and no response from Visa beyond silence; it is not known whether Visa disputes the findings or is simply slow to respond. Exploiting the flaw requires an expired physical card, proximity for the NFC relay, and technical setup, so this is not a mass, remote attack vector as reported, but a demonstrated protocol weakness that remains open more than a year after disclosure.
“Our results show that Visa contactless transactions are susceptible to man-in-the-middle tampering due to a lack of effective integrity protection.”
— the authors, in their paper