Expired credit cards revived by researchers to make unauthorized payments

Researchers at UMass Amherst demonstrated that certain Visa contactless EMV configurations do not cryptographically bind the expiration date used by the POS terminal to the date sent in the online authorization request, enabling an NFC man-in-the-middle proxy to make expired cards appear valid and complete transactions. The proof-of-concept affected Visa contactless cards in tests (Mastercard, AmEx, and Discover resisted the technique), banks showed mixed responses during authorization, and the authors disclosed the issue to Visa with no public confirmation of fixes.