Attack Resurrects Expired Visa Cards: Expiry Isn't Cryptographically Protected
UMass Amherst researchers showed that an expired Visa contactless card, whose account stays open after a replacement is mailed, can be brought back to life with two phones and a relay. The trick: rewrite the expiry date the POS reads over NFC while leaving the cryptographically signed Track 2 data untouched. Several of five major US banks accepted the tampered transactions. Neither Visa nor EMVCo has published a fix.