Flaw in Visa Contactless Protocol Lets Expired Credit Cards Approve New Charges

Contactless payment verification protocols contain a fundamental flaw that allows expired payment cards to execute fraudulent transactions. While the vulnerability does not impact every card network equally, security researchers have demonstrated that weak verification checks in certain tap-to-pay architectures enable real-world exploitation.

Standard point-of-sale systems can be tricked into accepting transactions from discarded credit cards through an architectural exploit nicknamed “zombie card” attacks. Computer scientists at the University of Massachusetts Amherst discovered that bad actors can manipulate the data exchange between tap-to-pay cards and payment terminals to complete unauthorized charges using expired plastic.

Findings detailed by assistant professor Taqi Raza and his research team were formally presented at the USENIX Security 2026 conference. Their peer-reviewed paper demonstrates how credit cards past their printed validity dates can bypass security checks on compromised point-of-sale (POS) terminals to authorize fraudulent sales.

The security gap stems from the fact that an underlying bank account remains open and active after a specific physical card reaches its expiration date and a replacement is issued. Capitalizing on this persistence, the UMass Amherst researchers successfully forced expired cards to clear transactions using a setup consisting of two commercial smartphones running custom emulation software to trick the terminal reader.

During the attack, a primary smartphone uses Near Field Communication (NFC)—the standard short-range protocol powering contactless checkout—to energize the expired card and extract its payment payload, including its official expiration date. A secondary phone functions as a man-in-the-middle proxy, transmitting the intercepted packet across Wi-Fi and modifying the expiration timestamp prior to delivering it to the POS terminal, which validates the altered date and processes the purchase on impacted systems.

Researchers identified the core vulnerability in the dual-layer handling of validity dates, where a card’s expiration metric is stored in two separate data fields: the Application Expiration Date parsed locally by the checkout reader, and an independent expiration parameter verified upstream during issuer authorization.

Within Visa’s contactless framework, these two fields lack cryptographic cross-validation, meaning real-time modifications to the local date bypass downstream verification mechanisms undetected. Equivalent configurations from Mastercard, American Express, and Discover successfully blocked the attack scenario during experimental testing, whereas Visa’s setup remained vulnerable.

Contactless card payments rely on the EMV standard, a global payment technology protocol established to replace magnetic stripes with dynamic cryptograms. In typical online transactions, payment terminals generate an Authorization Request Cryptogram derived from payload fields; if critical fields like expiration dates are omitted from the cryptogram’s hash calculation, inline relay devices can alter those unauthenticated data fields without invalidating the cryptographic signature sent to the issuing bank.

Raza emphasized that digital payment ecosystems rely on fragmented validation points across the payment chip, POS terminal, card networks such as Visa or Mastercard, and financial institutions, pointing out that security oversights naturally emerge when these separate entities fail to synchronize security rules.

“The attack exploits a documented misconception – expired cards are widely assumed inert, so cardholders discard them carelessly,” Raza said.

Protecting accounts against this contactless exploit ultimately requires physical destruction of discarded hardware before disposal. Complete mitigation involves demagnetizing the magnetic strip, cutting through the integrated circuit chip with scissors, shredding the plastic body, and distributing the destroyed fragments across separate waste bins to prevent physical reconstruction.