RESEARCHERS at the University of Massachusetts Amherst have shown that an expired Visa credit card can still be used for contactless payments because some terminals accept a tampered expiration date.
The flaw lies in the way contactless readers retrieve the expiry date from the card’s chip; on vulnerable devices the date field can be overwritten to a future year, allowing the card to pass the validity check, as detailed by Malwarebytes.
No CVE identifier has been assigned because the issue stems from inconsistent terminal implementations rather than a specific software bug, but the EMV contactless specification does not protect the expiration field against modification, according to The Hacker News.
So far there is no evidence of active exploitation in the wild, but the researchers demonstrated the attack in a lab setting, showing that a modified point‑of‑sale device could revive an expired card for a transaction.
Cardholders should physically destroy any expired Visa cards they no longer need and monitor their statements for unfamiliar contactless charges, reporting lost or stolen cards immediately to their issuer.
Issuing banks and payment networks must enforce server‑side expiration validation, ensuring that a transaction is declined if the card’s official expiry date is in the past, while terminal operators should apply firmware updates that lock the expiry field against alteration.