Expired Visa Cards Vulnerable to 'Zombification' Fraud
AI-generated image · US National Wire
Researchers warn that flaws in Visa's authentication chain allow fraudsters to use expired cards for contactless payments via phone-based proxies.
Expired Visa credit cards may pose a continuing security risk even after their official expiration date, according to reporting from Wired. Researchers from the University of Massachusetts Amherst revealed at the Usenix Cybersecurity Conference that fraudsters can "zombify" these dead cards to execute unauthorized contactless payments.
The technique involves using a man-in-the-middle app to relay data from an expired card through a pair of smartphones. According to Wired, the vulnerability exists because of flaws in the authentication chain of contactless payments. Specifically, Visa's implementation allows out-of-date cards to pass its initial checks, effectively shifting the responsibility of authentication to the cardholder's issuing bank.
While some banks successfully block these transactions, others do not. This creates a loophole where fraudsters can retrieve discarded cards—potentially through dumpster diving—and use them at point-of-sale terminals, particularly those without human attendants who might notice the proxy hardware setup.
When contacted by the tech news outlet the Register regarding the research, Visa did not respond to requests for comment.