Expired credit cards revived by researchers to make unauthorized payments
Gaps in expiry checks could let dead plastic make purchases again
Researchers affiliated with the University of Massachusetts Amherst have found that you can get payments out of certain expired contactless credit cards, a process detailed at the recent USENIX Security 2026 conference.
Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza describe their findings in a paper titled "Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments."
Credit cards, the authors explain in their paper, have expiration dates, but the way these dates get checked and enforced isn't consistent. Thus, they were able to devise an attack that makes expired contactless cards appear to be valid to payment terminals.
The Europay, Mastercard, and Visa (EMV) payment process involves a payment card (card or digital wallet in a phone) and a point-of-sale terminal communicating over a direct NFC channel, linked to a payment network (eg, Visa, Mastercard, Discover)...
Copyright of this story solely belongs to theregister.com. To see the full text click HERE
