The Register reports:
Researchers affiliated with the University of Massachusetts Amherst have found that you can get payments out of certain expired contactless credit cards, a process detailed at the recent USENIX Security 2026 conference.
Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza describe their findings in a paper titled “Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments.”
Credit cards, the authors explain in their paper, have expiration dates, but the way these dates get checked and enforced isn’t consistent. Thus, they were able to devise an attack that makes expired contactless cards appear to be valid to payment terminals.
Now you’d think — or hope — that card issuers would jump into action upon learning of this, but apparently, they may not have.
The authors say that they notified Visa of their findings in May 2025 and followed up in December 2025. Neither Visa nor the banks notified have confirmed that they’ve mitigated the expiration issue.
Visa did not immediately respond to a request for comment. Let the dumpster dive for discarded cards begin. ®
