UMass Team Revives Expired Visa Cards With 2-Phone Contactless Hack
Updated
Updated · Futura · Aug 21
UMass Team Revives Expired Visa Cards With 2-Phone Contactless Hack
3 articles · Updated · Futura · Aug 21
Summary
USENIX Security 2026 researchers showed expired Visa contactless cards can still authorize payments by relaying card data through two smartphones and changing the expiration date before it reaches a real terminal.
Visa was vulnerable because the EMV contactless protocol leaves the expiration date unencrypted, letting attackers alter it in transit while some issuing banks rely on terminal checks instead of verifying the date themselves.
Visa cards were the only ones the UMass Amherst team found susceptible in tests across Visa, Mastercard and Discover, and the attack works only with certain issuers rather than across the whole network.
May 2025 and December 2025 disclosures to Visa did not produce countermeasures, the researchers said, extending scrutiny of contactless-payment security after Mastercard separately patched a PIN-bypass flaw.