Expired Visa cards can still pay, which makes the expiry date a label and not a control

A relay setup forges nothing. The card is proxied through a man-in-the-middle app that carries its data between two phones ^[6], so the terminal is holding a conversation with a real card that happens to be somewhere else and out of date ^[5].

What settled the outcome was not the date. The researchers found that whether an expired card's transaction gets disallowed had been left to cryptography that various card issuers implemented differently ^[1], and Visa's own check carried a flaw that let out-of-date cards pass ^[2]. As the researchers describe it, Visa had effectively handed the job of authenticating these transactions to the cardholder's bank ^[3]. Some banks stopped the revived cards. Others did not ^[4].

That is the part worth sitting with if you build or run a card product. Expiry is a field you can read off the plastic and out of a token record. The decline is a behaviour, and on this evidence it is a property of the issuing bank rather than of the card or the network ^[12]. Any rule, reissuance schedule or customer-facing promise that treats the printed month and year as a boundary is inheriting whichever half of that split its issuer landed in, and nobody downstream can see which half that is.

The attack itself is unglamorous and cheap. It wants a card that was discarded intact or left lying around ^[8], and a checkout with no human at it to notice a phone rig standing in for a card ^[7]. Neither of those is a rare condition. The mitigation on offer to the cardholder is a pair of scissors ^[9], which is a reasonable piece of advice and also a statement about where the residual risk has been parked.

Two gaps in the record matter for how hard you should read this. Visa did not respond to requests for comment from The Register, which covered the research ^[10]. And the account does not name the banks that blocked the technique or say how many issuers were tested ^[11]. So the defensible conclusion is narrower than "expired Visa cards work everywhere": it is that expiry enforcement cannot be assumed from outside a specific issuer's decline logic, and the network was not the place it was enforced ^[3][12]. For a control that appears on every card in the wallet and in every product spec that references card lifecycle, that is a large amount of load resting on something no single party owns.