Vulnerability in Visa's EMV Kernel Allows Attackers to Use Expired Cards for Contactless Payments

A vulnerability in Visa's EMV kernel, known as Kernel 3, has been discovered by researchers from the University of Massachusetts Amherst. The weakness allows attackers to exploit an unsigned expiry field in Visa's contactless payment protocol, allowing them to make real purchases using expired cards.

The attack works by tampering with the expiration date that the payment terminal sees, replacing it with a future date while leaving the data sent to the bank unchanged. This is possible because the EMV protocol does not cryptographically bind the expiry date to authenticated protocol outputs. As a result, the card's digital signature remains valid, and the bank receives a transaction that appears legitimate.

The researchers demonstrated the attack at USENIX Security 2026 in Baltimore and found that it was successful against three banks with expired and replaced physical Visa cards. The test hardware used two NFC-capable Android phones running custom software over Wi-Fi to emulate a card and a terminal. Each communication round trip added around 20 milliseconds for relay alone, keeping the per-transaction average within Visa's 500-millisecond command limit.

The researchers found that none of the test hardware used EMV's optional Relay Resistance Protocol, which would have detected the added latency by bounding permissible response times. They also found that Mastercard, American Express, and Discover all blocked the attack through various measures such as binding expiry dates to issuer-verifiable signatures or requiring terminals to compare both expiry representations.