Story perspectives

Expired Visa cards fraudulently work after expiration-date rewrite

8/20/2026

Summary

Story summary

Researchers at University of Massachusetts Amherst proved expired Visa cards can be fraudulently used.
They built a two-smartphone relay that rewrites the card’s expiration date.
Visa terminals accepted the altered date, enabling $1, $100 and $500 lab purchases.
Mastercard, American Express and Discover rejected the tampered date due to cryptographic binding.
One U.S. bank only checked account existence, allowing the attack while another bank declined all attempts.

History

Historical Context

After earlier EMV flaws—most notably the 2020 ETH Zurich proof-of-concept that used two NFC phones to bypass Visa PIN checks—researchers at the University of Massachusetts Amherst have shown they can rewrite Visa card expiration dates, while Mastercard, American Express and Discover reject the altered data, prompting regulators to push stronger tokenization.

1 of 2

Story summary

Researchers at University of Massachusetts Amherst proved expired Visa cards can be fraudulently used.
They built a two-smartphone relay that rewrites the card’s expiration date.
Visa terminals accepted the altered date, enabling $1, $100 and $500 lab purchases.
Mastercard, American Express and Discover rejected the tampered date due to cryptographic binding.
One U.S. bank only checked account existence, allowing the attack while another bank declined all attempts.

1 / 2