Researchers at the University of Massachusetts Amherst have raised concerns about a new technique that allows expired Visa cards to be used for fraudulent contactless payments. This warning was issued during the Usenix Cybersecurity Conference, where the researchers explained how fraudsters could exploit vulnerabilities in the authentication chain of contactless payments. According to reporting by WIRED, the method involves proxying the expired card’s data through a man-in-the-middle app that connects two phones.
The researchers found that whether a transaction using an expired card would be rejected depended on the cryptographic implementations of various card issuers. Visa’s system had a specific flaw that allowed some expired cards to bypass checks. While some banks have measures in place to prevent the use of these “zombified” cards, others do not, potentially enabling fraudsters to make unauthorized payments using discarded or lost expired cards.
This alarming discovery highlights the importance of properly disposing of expired credit cards. The researchers emphasized that cutting up expired cards can prevent them from being misused by criminals who might find them in the trash.
As the cybersecurity landscape continues to evolve, incidents like this serve as a reminder of the vulnerabilities that can exist within payment systems, underscoring the need for ongoing vigilance and security improvements.
Follow Cyber Warriors Middle East for further global cybersecurity developments.
