TL;DR
- 01What happened
At USENIX Security in August 2026, researchers at the University of Massachusetts Amherst showed that an expired Visa contactless card could be made to look unexpired through a relay between card and terminal, and used to pay. The starting point is a physical expired card that was not securely destroyed.
- 02Why it can't be told apart
In Visa’s configuration the expiry the terminal reads was not covered by the card’s signature, so rewriting it on the way left the card’s other checks looking valid. Whether the payment went through depended on whether the issuing bank checked that card’s status against its own record.
- 03The missing layer
The researchers notified Visa and the banks in May and December 2025, and no mitigation had been confirmed at publication. What was missing was a layer in which the issuer checks the expiry the terminal reads against its own record of that card.
What happened
- Researchers
- Raja Hasnain Anwar, Gerard DeCunha and Muhammad Taqi Raza of the University of Massachusetts Amherst, in the paper “Zombie Cards Back Online” at USENIX Security 2026. This is a research demonstration, not a real-world loss.
- Starting point
- A physical expired card that was not securely destroyed. The authors note expired cards are often discarded carelessly. It is not a remote attack on every cardholder.
- Method
- Two phones formed a relay between card and terminal and rewrote only the expiry value the terminal reads. No specialized hardware was used, and it worked under ordinary in-store conditions.
- Why it passed
- In Visa’s configuration the expiry the terminal reads was outside the card’s signature, so the card’s cryptographic responses still looked valid. The issuer relied on a different expiry field in the authorization request, and the two values were not bound together.
- Brands and banks
- The Mastercard, American Express and Discover configurations rejected the altered expiry. Across five major US banks, some approved while others declined or asked for a replacement card. The issue was observed on $1, $100 and $500 payments.
- What the researchers did not do
- They did not break card cryptography or forge security responses, and are not releasing the relay code. Merchants were told in advance and every test charge was paid.
Glossary
Contactless payment (EMV) — Paying by tapping a card on a terminal. Card and terminal talk over short-range radio (NFC), and the terminal asks the bank for approval.
Relay — Placing devices between card and terminal to pass messages along. Here two phones did it, rewriting only the expiry value on the way.
Issuer — The bank that issued the card. It makes the final decision to approve a payment.
In the researchers’ tests, the payment went through in this chain.
The stopping point is ④. Had the issuer checked that card's expiry and status against its own record, the expiry rewritten at ③ would not have passed.
A physical card is needed.
No specialized hardware.
Outside the signature, so other checks look valid.
Banks that checked the card's status declined.
Timeline — disclosure and response
- The researchers notify Visa and the relevant banks.
- The researchers notify Visa and the banks again.
- Presented at USENIX Security 2026. The Register reports it on 18 August.
The facts rely on the paper’s abstract and the authors’ summary (primary). Press coverage repeats them. We do not claim real-world losses or victims. The number of cards or transactions tested and success rates were not published.
After disclosure
- Visa: According to the authors’ summary, the report passed initial triage and Visa’s testing team was reproducing it. At publication neither Visa nor the notified banks had confirmed a mitigation for the expiry issue. No CVE had been assigned.
- Researchers: Recommended that issuers and networks enforce expiry consistently end to end and check the status of the specific card rather than only the account. The Relay Resistance Protocol, which can detect a relay, was not enabled on the cards and terminals tested.
Why it wasn’t stopped
The failure was not that card cryptography was broken. Payments were approved without the expiry the terminal read being checked against the issuer’s record of that card.
The expiry lives on the card, but in Visa's configuration it was not covered by the card's signature. If the value the terminal reads is not bound to the one the issuer holds, an expiry rewritten on the way goes straight through.
Proof here means checking, before approval, that the expiry used for the decision matches the expiry of that card in the issuer's record. Detection means noticing an odd transaction afterwards.
card passes
Banks that checked the card’s status declined or asked for a replacement card. Banks that relied on the terminal’s decision and skipped checks for speed let the rewritten expiry through. That distance is the gap between detection and proof, and it is structural.
The same structure appears in Google API keys (keys that kept working for a while after revocation).
How to counter this
At authorization, check the expiry and status against the issuer’s own record of that card, not the expiry the terminal sent. The value the terminal reads can be rewritten on the way. Checking against your own record before approving means an expired card does not pass even when made to look valid. It sits in front of detection, not in place of it.
Industries and operations to watch
- IndustryFinance
- Banks that issue cards and approve payments, where some processing relies on the terminal’s decision for speed.
- IndustryRetail
- Stores that accept contactless payments. Whether relay detection is enabled on a terminal is hard to see from the store.
Do today’s controls close it?
| Control | This case | Why |
|---|---|---|
| Card cryptographic checks | Ineffective | The expiry was outside the signature, so the checks still looked valid. |
| Issuer authorization | Partial | Banks that checked the card’s status declined, but some approved. |
| Relay detection (RRP) | Partial | Optional, and not enabled on the cards and terminals tested. |
| Disposing of expired cards | Partial | Reduces the entry point, but carelessly discarded cards remain. |
- At authorization, check the card’s expiry and status against the issuer’s record. Confirm that this card number and generation is valid, not only that the account is.
- Do not approve transactions whose expiry does not match the record. Do not skip the check because of the terminal’s decision or processing speed.
- Put the expiry the terminal reads inside the signature. On the network and terminal side, also enable relay detection.
Three things to confirm for organizations that approve or accept card payments
- At authorization, do you check the expiry against your own record rather than the value the terminal sent?
- Do you confirm that the specific card (number and generation) is valid, not only the account?
- Do you tell cardholders how to dispose of expired or replaced cards (cut through the chip and stripe, or return them through an approved channel)?
Note: the researchers started from a physical expired card; this is not a remote attack on every card. We will revise this Brief if Visa or the banks announce a mitigation.
Sources
- Research, primaryUSENIX Security 2026 Anwar, DeCunha, Raza, “Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments”
- Research, primary, authors’ summaryKhwarizmi Lab “Reviving expired cards for contactless payments”
1 more (reporting, analysis)
- PressThe Register “Expired credit cards revived by researchers to make unauthorized payments”
References: “The last layer left in AI-era cyber defense”