Researchers uncover a loophole allowing expired credit cards to be used for fraudulent transactions, highlighting gaps in the current payment verification process and prompting calls for increased security measures.
Researchers at the University of Massachusetts Amherst have found that an expired credit card can sometimes be used again, exposing a loophole in payment security that could let old cards be revived for fraudulent purchases.
The team says the problem stems from the fact that a card account may remain active after the plastic itself has expired. That means an old card can still be tied to refunds or other account functions even after a replacement has been issued. In some cases, the researchers found, that same out-of-date card could also be pushed through a payment system.
Their demonstration used two standard smartphones and off-the-shelf software. Using near-field communication, the same short-range wireless technology behind contactless payments, one phone read data from the expired card and passed it to another device over Wi-Fi. Before the information reached a shop terminal, the system altered the expiry date to a future one. The researchers said attackers did not necessarily need to know the date on the replacement card, because entering any future date could work in some cases.
The weakness appears to lie in the way some systems handle the expiry date. According to the researchers, the date stored on the card is not cryptographically protected, which can allow a modified date to look legitimate to a payment terminal. In some instances, banks also failed to compare the date submitted by the terminal with authenticated card data. The team found that the attack could be carried out in laboratory conditions and in real dining and grocery settings, although not every card was vulnerable and digital wallets had extra protections that made the method harder to use.
The findings point to a wider issue in modern payments: responsibility is split between the card, terminal, card network and bank, and gaps can appear when those parts do not verify the same information consistently. The researchers have notified major card companies about the flaw. For consumers, the practical advice is straightforward: do not simply bin old cards. Cut up the chip, magnetic strip and account details before disposal, and follow issuer instructions for metal cards. Even after an account has been closed, it may still be worth checking statements for unusual transactions.
Disclaimer: This article is intended to inform and educate, not to recommend or endorse any financial product, investment or strategy. Please consider your own financial circumstances and seek professional advice where appropriate before making financial decisions.
