Card Expiry Fails When Authorization Checks the Account, Not the Card

Key takeaway

A newly disclosed contactless-payment weakness does not break EMV cryptography. It exposes something more ordinary and more useful to payments operators: an expiration date works only when the terminal, network and issuer enforce the same lifecycle state for the same credential.

Researchers from the University of Massachusetts Amherst showed that an expired physical card could complete contactless Visa transactions in controlled tests after a relay changed the expiry value presented to the terminal. The valid card cryptogram still reached the issuer. Some issuers rejected the transaction because they checked the exact card; others approved it because the underlying account remained active.

The practical lesson is narrower than the alarming headline and broader than the tested flaw. An expired card is not automatically dead. Expiry is a distributed policy decision, and every distributed decision needs an owner.

What’s changing

The paper, presented at USENIX Security '26, tested real cards, commercial terminals, informed merchants and five major U.S. banks. The researchers used two commodity Android phones to relay the contactless exchange and alter the application expiration date seen by the terminal. They did not extract a key, forge a cryptogram or compromise the issuing account.

Scope matters. The susceptible configuration in the study was Visa contactless. The Mastercard, American Express and Discover configurations tested rejected the changed expiry information. The result required physical access to an expired card, and the researchers did not establish the same behavior for chip-insert transactions. Apple Pay and Google Pay were also tested; the team says centralized token lifecycle management generally made wallets better placed to handle replacement.

Within that scope, the evidence is consequential. The researchers observed successful controlled payments at $1, $100 and $500. Amount, merchant type and terminal brand did not independently explain success. Issuer behavior did. A bank that verified the status of the exact credential could decline it; a bank that mainly saw a valid cryptogram on an active account could approve it. The project team says Visa and relevant banks were notified in May and December 2025, and that no mitigation had been confirmed when the paper was published. The researchers have withheld exploit-capable code.

Why it matters

Payments systems divide one decision across multiple parties. The card proves possession of a credential. The terminal applies local rules. The acquirer transports the request. The network defines message and kernel behavior. The issuer decides whether to authorize. Speed depends on each participant trusting fields and decisions produced elsewhere.

That division is efficient until two components are checking different facts. In the tested flow, the terminal could be shown an unexpired date while the issuer received a valid cryptographic response associated with the old card. The payment chain could therefore validate authenticity without consistently validating lifecycle state.

This is a useful distinction for fraud teams. Authentication asks whether the credential is genuine. Authorization asks whether the transaction should proceed. Lifecycle control asks whether this particular credential is still permitted to act. Treating those as interchangeable creates gaps around expired cards, replaced devices, closed tokens, revoked users and terminated agent permissions.

The flaw also shows why a control that exists somewhere is not the same as an end-to-end control. EMV includes an optional Relay Resistance Protocol that can detect added relay time. It was not enabled on the cards or terminals in the study. Issuers can also check the exact card state, but the different bank outcomes show that enforcement was not uniform in the tested sample.

For merchants, this is unlikely to justify a blanket change to contactless acceptance based on the public evidence. The demonstrated attack needs a discarded expired card and a proximate relay. The better response sits upstream: networks and issuers should bind lifecycle data to authenticated transaction evidence and make exact-credential status part of authorization.

What operators should do

Issuers should test authorization behavior by credential, not merely by account. A replacement card can leave the funding relationship active while the old credential should be unusable. Test matrices should cover expired, replaced, reported-lost and administratively revoked cards across contactless kernels, transaction amounts and fallback paths. Decline telemetry should distinguish an exact-card lifecycle decision from a broader account-status decision.

Networks and acquirers should document where expiry is checked, which copy of the field is trusted and whether that value is cryptographically bound to what the issuer evaluates. If a terminal decision can be overridden downstream, the downstream party needs reliable evidence. If it cannot be verified downstream, the kernel must reject tampering locally.

Merchants and terminal operators should inventory support for relay resistance and understand the latency and acceptance tradeoffs of enabling it. Optional controls tend to disappear in fragmented estates. A rollout plan should measure contactless completion time, false declines and fallback behavior alongside fraud exposure.

Card-replacement communications also need a sharper disposal instruction. The researchers recommend cutting through the chip and magnetic stripe or using an issuer-approved return process. “Your old card has expired” is not enough if the system still recognizes its cryptographic identity.

Finally, apply the same design test beyond plastic: when an account stays open but one credential should stop working, which system verifies the exact credential's current authority? That question belongs in wallet-token provisioning, API-key rotation, device replacement and delegated-payment controls.

Bottom line

The study does not show that every expired card can be revived. It shows that one visible deadline can mask several inconsistent control points. The remedy is not a stronger date printed on plastic. It is a transaction chain in which authenticated evidence, exact-credential status and authorization policy refer to the same object.

Source note: factual descriptions and test results are drawn from the USENIX paper page, the researchers' methodology and FAQ, and contemporaneous security reporting published August 21, 2026.