Worrying? The loophole that brings expired credit cards back to life
Has your credit card expired and you are about to throw it away? A study presented at the USENIX Security 2026 conference reveals that in some cases, the old card can still be used to make a payment. A team from the University of Massachusetts Amherst found a weakness in the contactless payment protocol that allowed researchers to make a terminal treat an expired card as if it were still valid.
Has your credit card expired and you are about to throw it away? A study presented at the USENIX Security 2026 conference reveals that in some cases, the old card can still be used to make a payment. A team from the University of Massachusetts Amherst found a weakness in the contactless payment protocol that allowed researchers to make a terminal treat an expired card as if it were still valid.
The researchers demonstrated the method using a contactless card that was no longer valid and two smartphones. One phone was placed near the card and effectively acted as a simulated payment terminal, capturing data from it. The information was transmitted to a second device, which posed as a card and was held up to a real payment terminal.
During the data transfer, the researchers changed the expiration date. As a result, the terminal received data indicating that the card was still valid and allowed the transaction to proceed. The vulnerability is related to how the EMV protocol for contactless payments works. According to the researchers, not all data transmitted during the transaction is encrypted. The expiration date, for example, is transmitted in a way that allows it to be changed under certain circumstances on its way to the terminal.
The researchers tested the method on cards from three payment networks: Visa, Mastercard, and Discover. According to the findings presented, only Visa cards were found to be vulnerable to this specific attack. Even in this case, it does not mean that every expired Visa card will allow a transaction to be made. The success of the method depends, among other things, on the issuing bank and the checks it performs when authorizing the payment.
According to the researchers, some banks rely on the checks performed at the terminal and do not perform additional verification sufficient to detect the manipulation. In such cases, the loophole may allow the transaction to be executed. According to the research team, Visa received a warning from them about the problem as early as May 2025, and another appeal was made in December of that year. The researchers claimed:
"They contacted Visa in May 2025 and again in December 2025, but neither Visa nor the banks implemented countermeasures that would block this type of attack."
The study joins previous discoveries about possible weaknesses in contactless payment mechanisms. In a separate case, a weakness related to Mastercard was found, in which it was possible to make a card appear to the system as if it belonged to Visa. In this way, it was possible to bypass the requirement to enter a PIN code and authorize contactless payments in amounts of thousands of euros or dollars. According to the article, Mastercard stated that its network has already been updated to block this method.
According to the information presented, this is not a simple method that anyone can perform. It requires appropriate equipment, technical knowledge, and certain conditions, and even then, it does not succeed with every card or bank. However, the findings undermine a basic assumption that the mere expiration of a card makes it completely worthless in terms of the possibility of using it.
The practical conclusion from the study is simple: even after receiving a new card, it is not advisable to throw away the old one intact. Physically destroying it, especially the chip, reduces the possibility that someone will try to use the details remaining on it.
