Researchers showed that some expired Visa contactless payment cards can be made to work again for purchases. The USENIX Security 2026 paper says the issue is in the EMV contactless flow, where the card expiry date seen by the point-of-sale terminal is not cryptographically bound in the tested Visa configuration, allowing a man-in-the-middle attack using NFC proxy phones to alter expiry data; success also depends on how the issuing bank handles online authorization.
Why it matters: This is a real payment-security weakness that could affect cardholders, banks, and merchants if attackers can place themselves between a card and terminal. Visa issuers and payment defenders should review authorization logic for expired-card checks, while affected users should still report any suspicious charges promptly.
info@thehackernews.com (The Hacker News)
2026.08.20
98% relevant
This is the same underlying event: research showing expired Visa contactless cards can be used for payments after expiration, framed here as the 'Zombie Card' attack.
2026.08.18
100% relevant
This article establishes a distinct new story about a newly reported weakness in Visa contactless payment processing that can let expired cards be used again under certain conditions.
← Back to all stories