Banks left the expiry check to the terminal, and Visa terminals took the bait

Delegation is the mechanism worth dwelling on. A contactless card hands over its data, the terminal decides whether the date on it is still valid, and the issuer treats that decision as done. According to the research team, that is the normal arrangement: banks leave the check to the point-of-sale device and trust its verdict ^[5]. Nobody had probed it because the assumption ran the other way, that the backend was the authority and would notice a date that did not match its own records ^[4].

The edit is possible at all because the payment data crossing the NFC interface is not fully encrypted, and some fields can be changed without invalidating the card's hash and signature ^[2]. The researchers' rig sits in the middle of that exchange, updates the expiration date, and relays the altered transaction onward to the terminal ^[3].

The split in the results is the interesting part. On terminals for Mastercard, American Express and Discover, changing the date produced a signature mismatch and the transaction failed ^[6]. On Visa terminals it went through ^[7]. One network in four accepted the rewrite ^[13], which points at terminal code rather than any scheme-level rule about what the signature must cover. If the protection were in the standard, it would not be a per-network coin flip.

Then the number that matters more than the terminal split: the study used five banks, and the altered transactions were not caught by any of their backends ^[7][8], a detection rate of zero out of five ^[12]. Every layer that was supposed to be redundant turned out to be the same layer.

Scale honesty first. Four networks and five banks is a small sample. It establishes that the delegation pattern is real and that at least one network's terminals do not bind the expiry field, not that the failure is universal.

What is not small is the cost of running the attack. No specialised hardware is needed; the kit is basic NFC emulators and POS terminals available for purchase online ^[9]. The gating factor is supply of dead plastic, pulled from the trash or taken from people who never destroyed their old cards ^[10]. That is a scavenging problem, not an engineering one.

Which is why the study's headline advice lands where it does. The researchers' main recommendation was not that Visa and the banks fix their terminals and backends, though they note that should be happening anyway, but that cardholders cut expired cards into tiny pieces ^[11]. It is a realistic reading of who can act this week. It is also an admission that the control everyone believed was enforced server-side is currently enforced by scissors.