- Researchers show how an expired contactless card can still complete a real purchase because the expiry date the terminal reads is not covered by its signature
- The attack needs physical possession of the discarded card and two ordinary smartphones, and results vary per bank, with Visa cards being susceptible in testing
- Existing EMV protections can detect the relay, but they are optional and were not enabled on any card or terminal tested, and neither Visa nor the notified banks have confirmed a fix is in the works
For a layman, the date printed on a credit card looks like a hard stop, but that might not always be the case.
