You probably shred old bank statements, but that dead Visa card in your junk drawer? Turns out it might not be as harmless as it looks. Researchers at the University of Massachusetts Amherst have shown that an expired Visa card can be “zombified” — reanimated to make contactless payments long after it should have stopped working.
The findings were presented last week at the Usenix Cybersecurity Conference, and they poke at an uncomfortable gap in how contactless payments authenticate themselves. The attack relies on a classic man-in-the-middle setup: a malicious app relays the card’s data through a pair of phones, effectively teleporting the tap between the physical card and a payment terminal somewhere else.
Here’s the clever — and worrying — part. When a contactless transaction runs, something in the chain is supposed to decide whether an out-of-date card should be refused. The researchers found that this check is handled by cryptography that individual card issuers implement differently. Visa’s implementation had a particular flaw: it essentially punted the job of authenticating these transactions to the cardholder’s bank.
And banks, as you might guess, don’t all handle it the same way. Some correctly blocked the reanimated cards. Others waved them straight through.
The practical upshot is grim in its simplicity. A fraudster could, in some cases:
- Dumpster-dive for a discarded but intact expired Visa card
- Feed its data through the phone-based proxy rig
- Push payments out of the unwitting owner’s account
The sweet spot for this trick is any unattended point-of-sale terminal — self-checkout lanes, kiosks, vending machines — where no cashier is around to raise an eyebrow at someone hovering two phones over the reader.
Visa did not respond to requests for comment from The Register, which reported on the research this week. That silence is notable given that the underlying issue isn’t a broken chip or a stolen PIN — it’s a design decision about who is responsible for saying “no” to a card that has already been retired.
It’s a neat reminder that the security guarantees baked into a payment card don’t necessarily expire on the printed date. As long as the chip and the account it’s tied to remain intact, the plastic can still whisper to a terminal — assuming your bank hasn’t independently slammed the door.
The fix on the consumer side is refreshingly low-tech. When a Visa card hits its expiry date and the replacement arrives, don’t just toss the old one in the bin. A quick pass with a pair of scissors through the chip and magstripe ensures it stays dead — and doesn’t reanimate in someone else’s hands.
