Expired Visa Contactless Cards Can Still Pay After Shredding Due to EMV Kernel Flaw
What Happened – Researchers from UMass Amherst demonstrated that expired Visa contactless cards can complete real‑world purchases. By exploiting an unsigned expiry field in Visa’s Kernel 3 EMV implementation, a relay attacker can present a future expiration date to the POS terminal while the bank sees the original (expired) date, allowing the transaction to be approved.
Why It Matters for Compliance & Audit Readiness
- The scenario is a textbook example of a credential‑use failure that SOC 2 CC6.1 (Logical Access) and CC7.1 (System Operations) are designed to detect, log, and remediate.
- Continuous monitoring of transaction anomalies and strict access‑control policies provide the audit evidence needed to demonstrate due diligence after a design‑level flaw is disclosed.
- A robust security‑awareness program helps staff recognize abnormal card‑present behavior and escalates potential fraud incidents promptly.
Who Is Affected – Payment‑card issuers, acquirers, merchants, and any organization that processes Visa contactless payments (financial services, retail, e‑commerce).
Recommended Actions
- Review and tighten logical‑access controls around POS terminals and NFC interfaces; ensure that expiration dates are validated end‑to‑end.
- Deploy continuous transaction‑monitoring solutions that flag mismatched expiry data between terminal and issuer fields.
- Update EMV kernel software as soon as Visa releases a patch; document the change management process for audit purposes.
- Incorporate this attack vector into security‑awareness training for staff handling card‑present transactions.
Source: Security Affairs
Technical Notes – The attack uses a man‑in‑the‑middle relay over NFC between two Android phones (one emulating a card, one a terminal). It manipulates tag 5F24 (Application Expiration Date) while leaving tag 57 (Track 2 Equivalent Data) unchanged, exploiting the lack of a cryptographic binding in Visa’s Kernel 3. No CVE has been assigned; the flaw is a design omission in the EMV specification.