Researchers at the University of Massachusetts Amherst have identified a vulnerability in contactless payment systems that could allow fraudsters to make purchases using expired Visa credit cards. The technique, dubbed "zombification," involves using a man-in-the-middle application to proxy an expired card's data through a pair of phones.
The findings, presented at the Usenix Cybersecurity Conference, reveal that the authentication process for contactless payments can be inconsistent across different card issuers. While some issuers' cryptographic implementations prevent transactions with expired cards, Visa's system was found to have a specific flaw.
According to the researchers, Visa's authentication chain effectively delegates the responsibility of verifying card expiration to the cardholder's bank. This means that while some banks successfully block transactions from "zombified" expired cards, others do not.
The practical implication of this vulnerability is that an individual could retrieve a discarded or lost expired Visa card and, using the described proxy method, potentially make unauthorized contactless payments. This risk is particularly elevated at point-of-sale terminals where no human attendant is present to scrutinize the transaction setup.
The research underscores the importance of securely disposing of expired credit cards. The researchers advise that simply cutting an expired Visa card can prevent its potential reanimation and fraudulent use. Visa has not yet publicly commented on the research findings.
