Expired Credit Cards Can Still Be Used for Purchases: Visa Flaw Exposed

A team of researchers from the University of Massachusetts Amherst discovered that expired Visa contactless credit cards can be used for purchases due to a flaw in the payment terminal's handling of expiration dates.

The team tested contactless cards across various brands, including Visa, Mastercard, American Express, and Discover, using multiple terminals and merchants. They found that while some cards were rejected when their expiration date was tampered with, others allowed for successful transactions.

The researchers identified the issue as a vulnerability in the Visa Kernel 3 contactless flow, where the terminal-facing Application Expiration Date is not effectively bound to the card's data. In contrast, Mastercard, American Express, and Discover kernels have built-in checks that detect modified expiry data and decline transactions.

The potential for abuse lies in the theft or recovery of an expired or replaced card, which can be used for contactless purchases using a relay setup. Cardholders are advised to physically destroy their expired cards by cutting through the chip and disrupting the contactless antenna.