The Challenge
Researchers at the University of Massachusetts Amherst found that expired Visa contactless cards can still be used for real purchases. The issue lies in the Visa Kernel 3 contactless flow, where the terminal-facing Application Expiration Date isn't properly linked to the card's cryptographic data. This flaw allows someone with an expired Visa card to alter the expiry date presented to the terminal, making the card appear valid.
The team tested cards from Visa, Mastercard, Discover, and American Express across various terminals and merchants, using cards from five major US banks. They successfully used expired Visa contactless credit cards for actual purchases, proving the vulnerability is real.
This is dangerous because expired cards are often seen as harmless. Your compliance team likely focuses on active card credentials in your Cardholder Data Environment. However, if expired cards in household waste, unsecured disposal bins, or lost wallets can still process transactions, there's a gap between perceived risk and actual exposure.
The Environment and Constraints
The vulnerability is specific to contactless transaction flows governed by EMV kernel specifications. Each card network has its own kernel with distinct security controls.
Mastercard, American Express, and Discover configurations rejected altered expiry data. Their kernels include checks that detect modified expiry information and decline the transaction. Visa Kernel 3, however, allowed terminals to accept a manipulated future expiry date without triggering validation failures.
Even within Visa's ecosystem, issuer behavior varied. Some transactions were declined or prompted for a replacement card, while others were approved. This inconsistency shows that authorization systems at different issuers don't uniformly validate card lifecycle state against the specific card credential presented.
The issue isn't just technical; it's operational. Your fraud monitoring systems likely flag unusual transaction patterns, velocity checks, or geographic anomalies. But an expired card used for small contactless purchases at familiar merchant categories might not trigger alerts if the underlying account remains open and the transaction appears normal.
The Approach Taken
The research team focused on the cryptographic binding between Cardholder Data elements. In a properly implemented contactless flow, the expiry date should be covered by the card's dynamic authentication data. When you tap a contactless card, it generates a cryptogram that authenticates the transaction, protecting the integrity of all transaction-critical data, including the expiry date.
Mastercard, American Express, and Discover kernels enforce this binding. If you alter the expiry date, the cryptogram validation fails and the terminal declines the transaction. Visa Kernel 3 didn't enforce this check consistently, allowing the terminal to accept a modified expiry date as long as other authentication elements passed.
The researchers used a relay setup that intercepts and modifies NFC communication between card and terminal. The attack requires physical possession of the expired card, not just proximity to a valid one. This differs from relay attacks against cards still held by their owners, which require sustained NFC proximity and a live relay during the transaction.
Results and Metrics
The researchers completed real in-store purchases using expired Visa contactless cards with modified expiry dates. The transactions processed through standard payment terminals at actual merchants. Mastercard, American Express, and Discover configurations rejected all attempts to use altered expiry data.
Issuer responses varied among Visa cards. Some issuers declined the transaction or prompted for a replacement card, suggesting their authorization systems validate card lifecycle state. Others approved the transaction, indicating their systems check only whether the underlying account is active, not whether the specific card credential is still valid.
This variance creates a compliance blind spot. If your organization issues Visa contactless cards, you can't assume that card expiry alone will prevent fraudulent use. Your authorization logic must explicitly validate that the card credential presented matches an active, non-expired card on file.
What They Would Do Differently
The researchers identified the root cause: insufficient cryptographic binding of expiry data in Visa Kernel 3. The fix requires network-level changes to ensure the Application Expiration Date is covered by authenticated data, similar to how other networks handle this field.
From an issuer perspective, the gap is in authorization logic. Your systems should validate not just account status but card credential lifecycle state. When a transaction arrives with a specific Device PAN or card sequence number, verify that credential is currently valid, not just that the account behind it is open.
Terminal implementations also matter. Payment terminals should reject transactions where critical data elements fail integrity checks, regardless of whether other authentication passes. If the cryptogram validates but the expiry date appears inconsistent with other Cardholder Data, that's a red flag.
Takeaways for Your Team
First, update your card disposal procedures. Your employee handbook probably tells staff to cut through the magnetic stripe. That's not enough for contactless cards. You need to cut through the chip several times and make additional cuts through the card body to disrupt the contactless antenna. If you handle corporate card disposal at scale, ensure your destruction process physically damages both the chip and the antenna coil.
Second, review your authorization logic. Don't rely solely on account status checks. Validate that the specific card credential presented in the transaction matches an active, non-expired card in your system. This applies to both your primary authorization flow and your fraud monitoring rules.
Third, if you issue Visa contactless cards, engage with your processor about kernel-level protections. Ask specifically how expiry data integrity is validated in your terminal configurations. If you're running Visa Kernel 3, understand whether your implementation includes additional checks beyond the baseline specification.
Fourth, adjust your fraud monitoring baselines. Expired cards used for small contactless purchases might not trigger your existing velocity or pattern rules. Consider adding specific monitoring for transactions on cards that should be expired, particularly if the transaction amount falls below your contactless limit.
Finally, treat lost or stolen expired cards as active incidents. Cardholders often don't report lost expired cards because they assume they're worthless. Your customer service scripts should clarify that expired cards still need to be reported, and your incident response procedures should include immediate credential revocation, not just account monitoring.
The vulnerability isn't in your PCI DSS controls. It's in the assumption that expired cards are inert. Close that gap in your authorization logic, disposal procedures, and fraud monitoring, and you eliminate the exposure without waiting for network-level fixes.
