Researchers at the University of Massachusetts Amherst have identified a vulnerability in the EMV contactless payment protocol that could allow expired Visa credit cards to be used for unauthorized transactions. The findings, presented at the USENIX Security 2026 conference, detail how a man-in-the-middle (MitM) attack can bypass expiration date checks for certain contactless Visa cards.
The research paper, "Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments," by Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza, explains that while credit cards have expiration dates, the enforcement of these dates within the EMV contactless protocol is inconsistent. This inconsistency creates an opening for attackers to make expired cards appear valid to point-of-sale (POS) terminals.
The EMV contactless protocol, which governs communication between payment cards (or digital wallets) and POS terminals via NFC, relies on selective authentication. Some transaction data is transmitted in plaintext and is only later linked to cryptographic verification through Offline Data Authentication (ODA) and issuer-verified cryptograms. This design allows for intermediary interference.
The researchers demonstrated that they could use NFC proxy devices to meddle with the transaction flow, specifically targeting Visa contactless transactions. They found that Visa's implementation of the EMV kernel, which processes these transactions, is more permissive than those used by American Express, Discover, and Mastercard.
According to the researchers, the Visa kernel does not cryptographically bind the expiration date. While the POS terminal evaluates processing restrictions based on an "Application Expiration Date," the card issuer relies on an expiration date from a different data field in the online authorization request. The lack of cryptographic binding between these two dates allows an attacker positioned between the card and the terminal to alter the expiration date seen by the terminal without invalidating the card's other security checks.
The success of the attack also depends on how the card issuer handles the transaction. The researchers found that some banks succumbed to the attack, while others did not, indicating varying levels of enforcement at the issuer level. The Wallet Card Transaction Qualifiers settings also play a role, potentially steering transactions toward online authorization checks rather than immediate rejection, shifting the enforcement burden to the card issuer.
Lead author Raja Hasnain Anwar noted that the susceptibility of Visa cards stems from design choices made by different card manufacturers in their contactless transaction protocols. While common messages ensure global acceptance, each manufacturer makes additional design choices, often compromising between backward compatibility with older POS terminals and performance criteria. He explained that although security checks are in place, only a subset may be invoked for faster transactions, creating vulnerabilities.
The researchers stated they notified Visa of their findings in May 2025 and followed up in December 2025. However, neither Visa nor the notified banks have confirmed that the expiration issue has been mitigated. Visa has not publicly commented on the findings.
