Researchers Warn Expired Visa Cards Can Be 'Zombified' for Contactless Fraud
US researchers found that discarded, expired Visa cards can be exploited for contactless payment fraud due to authentication gaps, and some banks fail to block such transactions.
Researchers at the University of Massachusetts Amherst presented findings at the Usenix Cybersecurity Conference showing that expired Visa cards can be reactivated for fraudulent contactless payments through a relay technique. The method uses a man-in-the-middle app that transmits the card's data between two phones, tricking payment terminals into accepting an outdated card.
A gap in the authentication chain
The researchers found that whether an expired card's transaction gets rejected depends on cryptography implemented differently across card issuers. Visa's system contained a specific flaw allowing expired cards to pass verification checks. Visa did not respond to a request for comment from tech outlet The Register, which first reported on the research this week.
According to the researchers, Visa effectively shifts the responsibility for catching these transactions onto the cardholder's bank. While some banks blocked the fraudulent "zombified" cards, others did not. This means a fraudster could potentially find a discarded but intact expired card and use it to make payments from the original owner's account, particularly at unattended point-of-sale terminals where no staff would notice a phone-based proxy setup.
What consumers can do
The researchers' recommendation is simple: cutting up an expired Visa card with scissors prevents it from being reused by anyone who might find it.
