[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMm5_SuxDiTpVY7s_cJjmCcm9oDfhLOvIBsFHuACIdW0":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":42,"controls":49},"d65d48e0-1745-48b9-8e63-a6766cdd8449","expired-visa-cards-exploited-for-contactless-payments-via-authentication-bypass","9f9ae05c-58e6-4130-a391-a5a43e3115e9","Expired Visa Cards Exploited for Contactless Payments via Authentication Bypass","Researchers discovered that expired Visa cards can be 'zombified' using a man-in-the-middle relay attack between two NFC-enabled phones, effectively bypassing the authentication chain in Visa's contactless payment protocol. The root cause lies in insufficient server-side validation of card expiry dates during contactless transactions, combined with weaknesses in how some banks enforce transaction authenticity checks. This matters because it undermines consumer trust in contactless payment systems and exposes financial institutions to fraud liability. The inconsistency in bank-level blocking also reveals a systemic gap — security controls that should be standardized across the ecosystem are instead left to individual issuers, creating exploitable weak links.","**Immediate actions:**\n- Financial institutions should enforce strict server-side expiry date validation for all contactless transactions regardless of terminal-level checks.\n- Issuers should audit their contactless transaction authorization logic to ensure expired card credentials are universally rejected at the backend.\n\n**Long-term improvements:**\n- Visa and card networks should mandate cryptographic transaction binding that ties each NFC payment to a unique, time-sensitive token to prevent relay attacks.\n- Banks should implement behavioral analytics to flag anomalous contactless transaction patterns, such as geographically impossible or high-frequency low-value payments.\n- Conduct regular red-team assessments of contactless payment authentication flows to proactively identify protocol weaknesses.\n\n**Detection measures:**\n- Deploy real-time monitoring to detect NFC relay attack signatures, such as unusual latency in contactless transaction handshakes.\n- Alert on any authorization attempts from cards flagged as expired in the issuer's card management system.",[12,13,14,15,16,17,18,19,20],"NIST SP 800-63B (Authentication Assurance)","NIST AC-17 (Remote Access Controls)","NIST SI-10 (Information Input Validation)","CIS Control 3: Data Protection","CIS Control 16: Application Software Security","PCI DSS Requirement 6.3 (Security Vulnerabilities Addressed)","PCI DSS Requirement 8.2 (User Identification and Authentication)","GDPR Article 32 (Security of Processing — appropriate technical measures)","ISO\u002FIEC 27001 A.14.1 (Security Requirements of Information Systems)",{},"published","2026-08-22T12:20:18.319739+00:00","2026-08-22T12:20:18.035+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fsecurity-news-this-week-your-expired-visa-card-could-be-zombiefied-to-make-contactless-payments\u002F","your-expired-visa-card-could-be-zombified-to-make-contactless-payments-e62140","Your Expired Visa Card Could Be ‘Zombified’ to Make Contactless Payments",[30,36],{"id":31,"name":32,"slug":33,"description":34,"color":35},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":37,"name":38,"slug":39,"description":40,"color":41},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",[43],{"id":44,"date":45,"edition":46,"title":47,"audio_url":48},"0f0be9d9-ab9b-456b-8dc5-f2c28971ff8d","2026-08-22","afternoon","ThreatNoir Weekend Brief — August 22","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-22\u002Fthreatnoir-afternoon-brief-2026-08-22.mp3",[50,54],{"slug":51,"name":52,"problem":53},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":55,"name":56,"problem":57},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control."]