Did you know there is still a good reason to physically destroy your expired credit card?
Scientific research found that the expiration date used by payment terminals on some contactless cards was not effectively protected against tampering.
University of Massachusetts Amherst researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza tested contactless cards across Visa, Mastercard, Discover, and American Express, using multiple terminals and merchants, and cards from five major US banks.
They found that a payment terminal could be tricked into seeing a future expiry date. Basically, they were able to modify the expiration date sent to the terminal to a future date. This allowed them to revive expired Visa contactless credit cards for real in-store purchases. Hence the name “Zombie Card.”
The result was not universal. The tested Mastercard, American Express, and Discover configurations rejected the altered expiry data, while issuer behavior differed even among the tested Visa cards: Some transactions were declined or prompted for a replacement card, while others were approved.
