Researchers at the University of Massachusetts Amherst have demonstrated a method to make purchases with expired Visa contactless credit cards, including at live retail and grocery merchants. The attack, presented at USENIX Security 2026, exploits a structural weakness in Visa's implementation of the EMV contactless payment protocol, specifically within its Kernel 3 software.
The vulnerability stems from an unsigned expiry field in Visa's EMV kernel. During a contactless transaction, the expiration date is presented twice: once in a field read by the payment terminal (tag 5F24, the Application Expiration Date) and once in a field read by the issuing bank (tag 57, Track 2 Equivalent Data). In Visa's Kernel 3, these two representations are not cryptographically linked.
The researchers developed a relay attack that intercepts the NFC communication between the card and the terminal. Using two NFC-capable Android phones running custom software, one emulating a card and the other a terminal, they were able to modify the expiry date seen by the payment terminal to a future date. Crucially, the data sent to the bank remained unchanged, preserving the card's valid digital signature because the expiry date is not covered by it.
This manipulation allows the bank to receive a transaction that appears legitimate and passes its normal security checks, despite the physical card being expired. The relay added approximately 20 milliseconds per communication round trip, with date modification adding another 30 milliseconds, keeping the total transaction time within Visa's 500-millisecond command limit. The test hardware did not utilize EMV's optional Relay Resistance Protocol, which could have detected the added latency.
Other major payment networks, including Mastercard, American Express, and Discover, were not susceptible to this specific attack. Mastercard's terminals check for consistency between the two expiry representations, treating a mismatch as an error. American Express binds the expiration date into the data covered by offline authentication, causing a hash mismatch if modified. Discover's kernel incorporates modified transaction objects into its verified transaction hash, leading to transaction failure. Visa's Kernel 3 lacks these protective measures.
The success of the attack also varied depending on the issuing bank. Researchers tested three banks with expired and replaced physical Visa cards. One bank (Bank A) accepted modified transactions at various amounts, including $1.00, $100.00, and $500.00 in lab settings, and completed real purchases of $2.79 and $3.19 at retail and grocery merchants. Bank A also alarmingly accepted simultaneous transactions from both an expired original card and its replacement against the same account. Another bank (Bank B) detected the modification but still accepted some transactions. A third bank, tested on Discover's kernel, declined the edited transactions but also exhibited the simultaneous-card problem without any modification.
Further findings revealed that the researchers could change the Consumer Device Cardholder Verification Method (CDCVM) flag at five US banks, with transactions succeeding at most of them. This flag, which controls how the terminal verifies the cardholder, can be altered because payment data can be modified in transit.
Another issue with Kernel 3 is its practice of sending a Terminal Verification Results (TVR) value filled with zeros to the issuer. This prevents the bank from knowing whether the terminal checked the card's expiry date or if that check failed, forcing the bank to approve transactions without full visibility into terminal-side validation.
The researchers concluded that the primary factors determining attack success are the EMV kernel in use and whether expiry data fields are cryptographically bound, issuer-side lifecycle enforcement regarding account and card instrument validation, and whether terminal-side validation results are visible to the issuer via TVR. Transaction amount, merchant category, and POS terminal brand did not independently influence the outcome.
The findings were disclosed to Visa in May 2025.
