As reported by SecurityAffairs, researchers at the University of Massachusetts Amherst have demonstrated a practical relay attack against Visa's contactless payment protocol that allows expired cards to complete real purchases at live merchants. The findings, presented at USENIX Security 2026 in Baltimore, expose a structural design flaw in Visa's EMV Kernel 3 that has implications far beyond a single academic exercise.
The Core Design Failure
The vulnerability is not a traditional software bug — it is a protocol-level integrity gap. Visa's contactless implementation presents the card expiration date in two separate fields: tag 5F24 (read by the terminal) and tag 57 (read by the issuing bank). Critically, neither field is covered by the card's cryptographic signature under Offline Data Authentication (ODA). This means a man-in-the-middle attacker can modify the terminal-facing expiry date without invalidating the card's digital signature or altering what the bank ultimately verifies.
This is a textbook example of what happens when authentication is applied selectively rather than end-to-end. The EMV protocol's reliance on partial cryptographic coverage creates an attack surface that no amount of terminal-side hardening can close — the trust model itself is fractured.
The fundamental issue: data objects consumed by the terminal for transaction decisions are not the same objects cryptographically bound to issuer verification. Any field that sits outside that binding is tamper-ready.
Attack Practicality and Exposure
The researchers used two NFC-capable Android phones running custom software over Wi-Fi — one emulating the card, one emulating the terminal — adding only ~20 milliseconds per round trip. This is well within the timing tolerances of contactless payment protocols. The attack was validated against live retail and grocery merchants, not just lab simulations.
| Attribute | Detail |
|---|---|
| Protocol | Visa EMV contactless (Kernel 3) |
| Root Cause | Unsigned expiry date field (tag 5F24) not bound to ODA signature |
| Attack Vector | NFC relay via two Android devices |
| CVE Assigned | Not reported as of publication |
| CVSS Score | Not assigned — protocol design flaw |
| Patch Available | No vendor patch announced; requires protocol-level redesign |
| Active Exploitation | Research demonstration only; no reported in-the-wild abuse |
| Affected Parties | All Visa contactless cardholders globally; merchants accepting Visa tap-to-pay |
Why This Matters Beyond Expired Cards
While the headline focuses on expired cards, the deeper concern is the class of vulnerability this represents. The same selective-authentication gap that allows expiry date tampering could theoretically be extended to other unsigned, decision-critical fields in the EMV contactless flow. Any terminal-side evaluation that relies on plaintext data outside the cryptographic binding is a candidate for manipulation.
For financial institutions, this raises uncomfortable questions about the assumptions underlying contactless payment fraud models. If an expired, shredded card pulled from a trash bin can be revived for live transactions, the entire lifecycle assumption — that physical destruction renders a card useless — is broken.
What You Should Do
For Card Issuers and Banks
For Merchants and Payment Processors
- Deploy relay-resistant terminals: Where available, enable distance-bounding protocols or relay-detection features on contactless payment terminals.
- Monitor for anomalous contactless patterns: Unusually short intervals between failed and successful taps, or transactions from cards flagged as expired in issuer databases, should trigger alerts.
For Consumers
- Shredding expired cards is still good practice, but recognize it is no longer a guarantee. Report any suspicious contactless transaction activity immediately.
Broader Implications
This research underscores a persistent truth in payment security: protocols designed for interoperability across thousands of institutions inevitably trade security for flexibility. Visa's Kernel 3 implementation made a design choice to leave certain fields unsigned for performance and compatibility reasons. That trade-off is now exploitable. As contactless and mobile payments continue to dominate global commerce, the industry must confront the reality that selective authentication is not a feature — it is a liability waiting for the right adversary.
The absence of a CVE or vendor patch at this stage is notable. Protocol-level flaws of this nature typically require coordinated multi-party remediation through standards bodies, meaning the window between disclosure and widespread mitigation could be measured in years, not months. Defenders should plan accordingly.
