RESEARCHERS from UMass Amherst have demonstrated that expired Visa contactless credit cards can still make valid purchases by exploiting a vulnerability in Visa's EMV payment protocol. The study, presented at USENIX Security 2026, reveals that a man-in-the-middle attack can manipulate the expiration date visible to the payment terminal while keeping the transaction valid for the bank.
The attack leverages a flaw in Visa's Kernel 3, which does not cryptographically bind the expiry date checks, unlike protocols used by Mastercard and American Express, which block such fraud attempts. The researchers observed varying responses from different banks regarding the acceptance of modified transactions. Their findings suggest urgent improvements are needed in card expiration verification processes to prevent such security breaches.