Contactless payment risk with expired credit cards

Researchers at the University of Massachusetts Amherst have revealed that expired credit cards can be manipulated for contactless payments.

12punto 24 August 2026

The expiration date printed on credit cards typically signifies to users that the card is no longer functional. However, a study by researchers at the University of Massachusetts Amherst has shown that certain checks within the contactless payment infrastructure do not guarantee this limit in all cases.

Expired cards, which the researchers describe as "zombie cards," can be used to make payments at contactless POS terminals under specific conditions. According to the findings, the issue does not stem from cracking card passwords, but rather from the insufficient verification of certain information transmitted during the payment process.

According to the research, the expiration date on the card forms a critical control area in the contactless transaction flow.

RISK OF DATA TRANSMITTED IN PLAIN TEXT

A contactless payment transaction is completed through communication between the physical card, the POS device, the merchant's bank, the card network, and the issuing institution. Whether a transaction is approved or not is determined by the checks within this chain.

According to the study, some data in the contactless payment flow can be transmitted as plain text rather than being encrypted or subjected to cryptographic verification. The expiration date information, which also appears on the physical surface of the card, stands out as one of these unprotected areas.

In contactless payments, the data flow between the card and the terminal is important in terms of security checks.

It was stated that in the examined Visa infrastructure, the date information read by the POS device is not included in the card's digital signature protection. This situation can allow an external device inserted between the card and the terminal to modify the expiration date data.

According to the research, if the expired date information is replaced with a valid date during the transaction, the terminal may approve the payment. Even if the date on the plastic surface of the card has passed, if the digital certificate inside the card remains valid, this check can be bypassed.

According to experts, the findings bring the importance of verification rules in contactless payment infrastructures back to the agenda.

The findings reveal that contactless payment systems require not only the physical information of the card but also the cryptographic verification of this information. The research points to the need to strengthen rule checks in payment infrastructures.