Canonical version: https://thelooplet.com/posts/best-way-to-harden-contactless-payments-for-expired-card-abuse

Best Way to Harden Contactless Payments for Expired Card Abuse

TL;DR: Expired contactless cards can be revived through a lax EMV expiration check, so developers must enforce cryptographic expiration validation, disable legacy kernels, and add runtime integrity checks to protect merchants and issuers.

Introduction

In August 2026, researchers from the University of Massachusetts Amherst demonstrated a practical attack that resurrects contactless credit cards past their printed expiration dates. By exploiting inconsistencies in how EMV kernels enforce the Application Expiration Date, they turned “dead” plastic into a functional payment instrument (Source: The Register). The attack requires only an NFC‑enabled phone acting as a proxy, meaning any attacker with modest hardware can weaponize discarded cards.

The fallout is immediate: merchants may unknowingly accept fraudulent transactions, issuers face charge‑back exposure, and payment‑app developers must revisit their validation logic. The core problem is not a cryptographic flaw in the card itself but a design decision that leaves expiration checks to the point‑of‑sale (POS) terminal rather than binding the date to the card’s cryptogram. This article dissects the vulnerability, outlines how the attack works, and provides a concrete hardening roadmap for anyone building or maintaining EMV‑based payment stacks.

Our thesis is simple: secure contactless payment implementations must treat the expiration date as a signed attribute, not a mutable field that a terminal can ignore. The remainder of this piece explains why that distinction matters and how to enforce it.

EMV Contactless Architecture

The EMV (Europay, Mastercard, Visa) specification defines two parallel data flows for contact and contactless transactions. In a contactless flow, the card and the POS terminal exchange a short‑range NFC message that contains a subset of the card’s data elements, including the Application Primary Account Number (PAN), the Application Expiration Date, and a cryptogram generated by the card’s Secure Element.

Critically, the specification allows the terminal to perform offline data authentication (ODA) using a static data authentication (SDA) or dynamic data authentication (DDA) signature. However, the expiration date itself is not cryptographically bound to the card’s private key. Instead, the terminal is expected to compare the date with its own policy and reject the transaction if the card is stale. This design gives each card brand the freedom to implement its own “kernel”—a software component that parses the TLV (Tag‑Length‑Value) data and decides whether to forward the transaction for online authorization.

Visa, Mastercard, American Express, and Discover each ship proprietary kernels. The research highlighted that Visa’s kernel is the most permissive: it does not embed the expiration date into the cryptogram, leaving the check entirely to the terminal (Source: The Register). When a terminal’s firmware is outdated or misconfigured, it may simply skip the date validation, allowing an expired card to proceed to the online network where the issuer’s back‑end may also neglect a hard check.

The Expired Card Vulnerability

The attack exploits two independent weaknesses: (1) the lack of cryptographic binding of the expiration date and (2) inconsistent enforcement across kernels and issuers. The researchers built a “Zombie Card” proof‑of‑concept that reads the card’s data, rewrites the Application Expiration Date to a future value, and then re‑encodes the record without altering the card’s signature because the signature does not cover the date field.

To make the attack practical, they used a commodity Android phone with NFC capabilities as a man‑in‑the‑middle (MITM) proxy. The phone intercepted the card‑to‑terminal exchange, injected a fabricated expiration date, and forwarded the modified message to the POS. Because the terminal trusted the NFC payload, it accepted the transaction and sent an online authorization request to the issuer. The issuer, depending on its own kernel, either accepted the transaction (Visa) or performed a secondary check that could be bypassed by forcing an online fallback where the expiration date is again ignored.

The researchers reported that reviving a single expired card required only a handful of NFC messages and a few seconds of processing. In a real‑world scenario, an attacker could batch dozens of discarded cards, embed them in a “card‑farm,” and use a single phone to harvest fraudulent purchases across multiple merchants.

Attack Vector Details

The attack chain can be broken down into three stages:

1. Data Extraction – Using a standard NFC reader, the attacker captures the card’s Application Data File (ADF) which includes the unencrypted expiration date and the card‑generated cryptogram. The data is read in clear because contactless transactions deliberately expose a minimal set of fields for speed.
2. Payload Mutation – The attacker modifies the expiration date field to a future timestamp (e.g., adding 5 years). Since the cryptogram does not sign this field, the modification does not invalidate the card’s signature. The altered TLV payload is then re‑encoded.
3. MITM Relay – The phone acts as a transparent relay between the victim terminal and the card. It injects the mutated payload on the fly, allowing the terminal to believe it is communicating with a fresh card. The terminal’s kernel, especially Visa’s permissive implementation, does not flag the discrepancy, and the transaction proceeds to the issuer.

The researchers also noted that Visa’s kernel treats the expiration date as a processing restriction rather than a security attribute. The POS terminal is expected to enforce the restriction, but many terminals lack firmware updates that would reject stale dates. As a result, the attack succeeds even on relatively modern terminals that have not been patched.

Mitigation Strategies for Developers

Developers responsible for POS software, payment SDKs, or card‑issuer back‑ends must adopt a defense‑in‑depth posture. Below are concrete steps:

• Enforce Cryptographic Expiration – Update the kernel to include the Application Expiration Date in the card‑generated cryptogram (e.g., using DDA). This binds the date to the card’s private key, making any post‑issuance modification detectable.
• Reject Legacy Kernels – Detect the kernel version via the Application Interchange Profile (AIP) and refuse transactions from kernels known to be permissive (Visa’s older kernel). Force a fallback to online authorization where the issuer can perform a hard date check.
• Server‑Side Date Verification – Even if the terminal validates the date, the issuer’s back‑end must re‑check the expiration against its own records before approving the transaction. This prevents terminals that skip the check from becoming a weak link.
• Firmware Update Policy – Mandate that all POS terminals run firmware released after August 2026 that includes the revised expiration validation logic. Provide a secure OTA mechanism to push patches.
• NFC‑Proxy Detection – Implement timing analysis on the NFC exchange. A MITM proxy introduces measurable latency (typically > 10 ms) compared to a direct card‑terminal interaction. Flag transactions that exceed a configurable threshold for additional verification.
• Transaction Limits for Low‑Risk Cards – For cards flagged as “expired‑date‑mismatch,” enforce a lower transaction ceiling (e.g., ≤ $10) and require PIN entry or biometric confirmation.

By integrating these controls at multiple layers—card, terminal, and issuer—developers can dramatically reduce the attack surface.

Testing and Validation

Hardening a payment stack is only effective if the changes are verified under realistic conditions. Developers should adopt the following testing regimen:

• Negative Test Cases – Programmatically construct expired‑date payloads and attempt a transaction on a test terminal. Verify that the terminal rejects the transaction before reaching the issuer.
• Kernel Compatibility Matrix – Build a regression suite that runs each supported kernel version against a set of malformed payloads. Log any kernels that allow the transaction to pass.
• Live‑Traffic Simulation – Deploy a sandbox POS environment that mirrors production traffic. Use a controlled NFC proxy to inject mutated cards and ensure detection mechanisms trigger alerts.
• Compliance Audits – Align with PCI DSS Requirement 6.5.5, which mandates secure coding practices for payment software. Document the cryptographic binding of expiration dates as a control.
• Continuous Monitoring – Enable real‑time logging of expiration‑date mismatches. Feed these logs into a SIEM to detect potential abuse patterns.

Regularly scheduled penetration tests that include the “Zombie Card” scenario will keep the implementation robust against evolving attack techniques.

Industry Response and Standards Evolution

The disclosure has already spurred a response from major card networks. Visa announced a forthcoming kernel update that will incorporate the expiration date into the DDA signature, slated for Q4 2026. Mastercard and American Express have indicated they will review their kernel specifications but have not committed to a timeline.

PCI Security Standards Council (PCI SSC) is expected to issue an advisory note that treats expiration validation as a critical security control rather than a policy control. This shift will likely be reflected in the next version of the PCI DSS, where non‑cryptographic expiration checks will be deemed insufficient for compliance.

For developers, the practical upshot is that relying on “legacy compliance” will no longer be safe. The industry is moving toward a model where every mutable card attribute is cryptographically sealed. Early adopters that retrofit their stacks now will avoid costly retrofits later.

What This Actually Means

The real story is not that contactless cards are inherently insecure; it is that the EMV ecosystem delegated a critical security decision—expiration validation—to the weakest link: the POS terminal firmware. Teams that continue to trust legacy kernels are exposing themselves to a low‑effort, high‑impact attack that can be automated at scale. My prediction is that within 12 months, at least three major issuers will enforce server‑side expiration checks, and merchants that have not updated firmware will see a spike in charge‑backs, prompting a rapid migration to the new kernels. In short, developers must treat expiration dates as signed data today, or face operational risk tomorrow.

Key Takeaways

• Implement cryptographic binding of the Application Expiration Date in the card’s DDA signature to prevent post‑issuance mutation.
• Reject transactions from known permissive kernels (e.g., older Visa kernels) and enforce server‑side expiration verification.
• Deploy OTA firmware updates to all POS terminals and enforce a minimum version that includes hardened expiration logic.
• Add latency‑based NFC‑proxy detection and enforce lower transaction limits for cards flagged with mismatched dates.
• Incorporate “Zombie Card” test cases into your continuous integration pipeline to ensure future regressions are caught early.

Read Next

• How to Fix Critical Linux Kernel CVE-2026-68278 CVE-2026-68284
• Best Way to Harden Cloud Gaming Streams Against Host OS Escape
• AI Scanning vs Manual Pen Testing: Which Secures Chrome Faster

Read next: continue with one of these related guides.

---

Originally published at The Looplet.