Researchers Show Expired Visa Cards Can Be Repurposed for Contactless Fraud

During the Usenix Cybersecurity Conference, scholars from the University of Massachusetts Amherst presented a new attack that breathes life into expired Visa cards, turning them into tools for unauthorized contactless purchases. By using a proxy app that shuttles card data between two phones, the attackers exploit gaps in the authentication chain, where Visa’s system hands off verification to the issuing bank. Because banks differ in their handling of such transactions, some allow the zombified cards to be used, especially at self-service points lacking human oversight.

The researchers noted that Visa’s specific flaw permits out-of-date cards to pass its checks, and Visa declined to respond to inquiries. They advised cardholders to physically destroy expired cards, for example with scissors, to eliminate the risk. The broader implication highlights the need for uniform security standards across issuers to protect consumers from this emerging form of fraud.