Expired credit cards revived by researchers to make unauthorized payments Researchers affiliated with the University of Massachusetts Amherst have found that you can get payments out of certain expired contactless credit cards, a process detailed at the recent USENIX Security 2026 conference. Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza describe their findings in a paper titled "Zombie …
Who here among the Reg commentariat isn't shredding/cutting their expired credit cards as a matter of routine?
Yeah, we're (OK, myself excluded) more tech- and security-literate than the average, but even my non-technical family shred their old cards. It's just common sense.
>Bins must be at least a mile apart
? The cards are made of plastic not "mimetic polyalloy"...
However, I think the safe destruction of bank cards et al, is probably a good use case for a Camping Jet Lighter:
These can be had for £7.99 on Amazon, alternatively you can risk purchasing through an in game ad's with "A SPECIAL LIMITED-TIME OFFER | UP TO 70% OFF" for £39.99.
"alternatively you can risk purchasing through an in game ad's with "A SPECIAL LIMITED-TIME OFFER | UP TO 70% OFF" for £39.99."
but has it been invented by some random person at some random educational establishment, who found a way to revolutionise Big Lighters grip on lighters?
That will protect customers, maybe not card issuers from dodgy customers.
Customer along with an accomplice use an expired and current card at different locations 20 miles apart within 1 minute of each other.
Does the bank refund one payment as it’s clearly fraudulent, letting the dishonest customer profit?
Probably. You may not even have to work that hard unless you have a history of fraud attempts. Aspiring fraudsters should be careful of several more things, including the cameras that might be recording them, because not only can that bust the original fraud plan, but you can be charged with identity theft even if the person you're impersonating gave you all the details as the bank and the shop have standing.
>Does the bank refund one payment as it’s clearly fraudulent, letting the dishonest customer profit?
From my experience a common transaction is a supermarket click-and-collect. If the purchase goes through you only need to have the collection code to pick up the goods. So regardless of bank refund, the "dishonest customer" profits as they get to disappear with the goods.
You (and many others) might be missing the point.
The question I have is what is the level of information needed to recreate a "valid" bank card and is it possible from the amount of information many organisations retain for "one click" checkout...
On a slightly different note, a major UK bank when it contacts you with respect to potential fraud, will give you a reference code - remember this as you can then call their customer services give them the reference and they can confirm it was one of their staff who called you.
I don't shred mine because the city will take my shredder's leavings as part of my compost/yard waste bin, but getting plastic card debris in there would force that to the trash instead.
I cut it into two pieces, one with the last six digits and half the chip, the other with the rest. One goes into my kitchen bin which is cleared out weekly, the other into the bin in the bathroom adjoining my guest bedroom which is only emptied when I have a guest.
Neither piece on its own is remotely sufficient to get my card number, and they are very unlikely to be on the curb at the same time. If they ever are they'd be in separate bags so some stranger would have to tear through all my trash and where I live that's just not a thing.
You can buy biodegradable cat litter which is compostable. I would do that, if I had a cat. I wouldn't even need to buy paper bags to put it in, since Amazon uses those instead of plastic most of the time these days, so if you order much from Amazon you'll always have some handy.
The first 6-8 digits are fixed as per the payment processor and type of card, which likely could be determined from any chunk of the relevant card.
With the last 6 digits, there are 2-4 digits to guess to have the full card number.
As the last digit is a check digit, guessing the full card number is much easier as there is confirmation if a guess is potentially correct or not (plus with only 999,999-99,999,999,99 possible card numbers, a fraudster randomly guessing a valid card number, expiry date and CVV wouldn't be impossible).
Credit card numbers are not random. They follow international standards (ISO/IEC 7812) and use a structured 12-to-19-digit format that identifies the industry, card network, issuing bank, specific account, and a mathematical check digit.
Structure of a Credit Card NumberFirst Digit (Major Industry Identifier): Shows the business category. 3 is for travel and entertainment (like American Express), 4 is for Visa, 5 is for Mastercard, and 6 is for financial or discovery cards.
Digits 2–6 (Issuer Identification Number): Also called the Bank Identification Number (BIN). This identifies the exact financial institution or bank that issued the card.
Middle Digits (Account Number): A unique sequence chosen by the issuer to connect the card to your specific personal bank account.
Last Digit (Check Digit): A single validation number calculated using the preceding digits.
The Luhn Algorithm:The final number on a credit card is a "checksum" generated by the Luhn algorithm (created by IBM engineer Hans Peter Luhn in 1954).Computers run a formula doubling and adding specific digits in the sequence.If the final calculated sum ends in zero, the sequence is a valid card number.
This prevents typing errors and instantly flags fake or mistyped numbers at checkout without needing to access an external database.
I was involved in the check printing industry in the 80's-90's working on presses and LinoType machines. We had access to all US banks algorithm for generating checking account numbers. This was how we could preprint checks for new bank customers starter checks(100 checks per new account).
When a current bank customer would reorder checks(200 checks minimum) we would run the account number through that banks algorithm and it would spit out a yes or no possibility of the account being real.
I have seen a map of the Luhn algorithm. The vast amount of bit manipulation/shifting, adding and subtracting is amazing to see.
Why post badly copy-pasted text, or LLM slop at me, even if you've added your own text to the end?
Accounts numbers with limited digits, not being randomly assigned is a bad idea - as any bias in the account number assignment algorithm that causes uneven assignments, would limit the number of accounts to be a fraction of the number space and likely allow fraudsters to guess valid account numbers while triggering few invalid-account errors (warnings should trigger at a bank, if it was detected that a merchant has attempted to bill hundreds of invalid account numbers).
That's not the point, the point is that the Expiry Date isn't included in the set of information that is encrypted and then compared for basic validation. If it were, you couldn't fake a valid Expiry Date at the retail end because it wouldn't match with the encrypted value on the back end. That's what I understood from the article anyway. If you've done an online Payment Provider integration, you'll understand what I mean.
What is included in the cryptogram (a MAC over the data specified in the Card Data Object List) is set by the card issuer.
It seems difficult to get right, a few years back there was an attack that returned a "success" from the terminal on PIN verification. The issuer forgot to include the card internal result in the MAC. Doh!
a similar issue was in the EMV 3dsecure protocol (version 1, fixed in 1.1...)
all the authentication information was included in the MAC. apart from the summaryResult=Y|N part.
guess how many banks only looked for a Y and a valid MAC to accept the authentication instead of validating the authentication data...
There are plenty a Mom and Pop pizza shop, cStore, restaurants etc that are still taking swipe and sign in the USA.
Contactless payments is still patchy with some big players like Walmart still refusing to implement it (or Apple/Google-Pay).
Hardware is cheap, and even not necessary via tap to pay on phone options for retailers.
Madness.
In banking terms the US is way behind the UK.
I worked there 1998-2000 at a time where in the US direct debits were only just coming in ... initially I was signing 7 or 8 cheques a month to pay bills (which explained why when I opened our bank account I was sent a box of cheque books with a two or three hundred cheques in them). Then after a bit my bank sent me their "new invention" of a "check card" - you just swiped it in a shop instead of writing a check - is a debit card that had been standard in the UK for around a decade!
If is improving still behind. Direct payment is years behind UK’s free and *near instant Faster Payments with 3rd party scum like Zelle, Venmo, Apple Cash, Visa Cash App being prominent, and like everything in USA skimming a fee off every transaction.
*For some older institutions with legacy tech it can take a couple of house and nothing out of hours… but still better than USA. Global FinTech/banks like Revolut expanding there will help.
Yep Walmart's resistance to contactless payments are because they want to push their app rather than paying processing fees to Visa/MC. So the more friction they can add to using cards versus their app or cash the better as far as they're concerned.
If they could they'd make you use those old style card impression devices that leave you a carbon copy receipt which smudges your hands!
"Wow - and I had always thought the US was the future - not the past.Not that we in the UK can boast. On a recent trip to Sicily I couldn't get a menu without recognising a QR code with my smartphone."
Then we can boast. Because not being able to get a menu without a QR code is a step backwards, not forwards.
Am I the only one who would go to a restaurant without my phone?
(not my downvotes though!)
you authenticate with a signature
The signature is not authentication. The signature is your agreement that you will pay the account.
It's not entirely madness -- your act of signing has legal consequences -- but it is an old way of doing things, and probably unnecessary even in any of the 50 states.
I live in the Midwest and I see that even in places that don't have tips. My chiropractor's payment terminal requires a signature when I pay for the month with Apple Pay. Apparently $50 is the line it uses. You sign on the terminal's screen so I just make a random scribble to keep it happy.
There is no "chip and PIN" anywhere in the US, at least not that I've ever seen. Well maybe for debit cards but I never ever ever use one to pay, and never will.
That they are finally going to support Apple/Google Pay and contactless cards. All the other big players that were holdouts had already folded in the past year, now Walmart has thrown in the towel.
The only major retailer that still won't accept Apple Pay is Amazon, but I'm fine with that since I use Amazon's credit card and get 5% cash back. Only app I have a card saved as payment method for anymore. Everything else I use Apple Pay or if they don't have that I use Paypal.
are why I've lived my entire life without a credit card, though my bank keeps vigourously offering encouraging me to get one, via snail mail and via in-person teller interactions.
Yes, it's sometimes an inconvenient lifestyle, but I feel it's worth the trouble.
Online payment services, such as PayPal and the like, also can take a long walk off a short dock.
If you want to buy something from anything you're not present at, how do you do it? If you're using a debit card, it's the same system, probably also vulnerable to this. If you're using neither, do you have a solution to that? I'm not sure your reasons are valid, but it's your choice. I'm just curious how you buy things for which I find myself needing a card. I suppose it's not impossible to simply refuse to buy anything you can't buy by handing over cash, but I think it would be quite limiting.
@ doublelayer:
I don't buy things online if I have to use Paypal, etc., or a credit/debit card. I recently bought a book online through a bookstore's system, but I couldn't just pay the bookstore, and have the bookstore order it. The workaround was that I bought a gift card at the bookstore for the price of the book, and used that gift card in their online system. The book was then delivered to the bookstore, and I picked it up there.
It is getting more and more difficult, though, as more and more bricks-and-mortar store chains are going to a 20/80 model, where they have 20% of their items -- the most profitable/popular ones -- in-stock, and everything else is "order it online". The people in charge of this clearly have no idea what the purpose of a bricks-and-mortar store is. (Hint: it is NOT so that some minimum wage drone armed with a cellphone and a web app can cheerfully tell me, "You can order that online." It SHOULD be obvious that if I WANTED to order it online, I'd do just that, and not be wasting time standing in their physical store.)
@ retiredFool:
The last time I rented a car (a careless driver had damaged my personally-owned car while they were parking theirs), the rental agency was happy to take a cash deposit. When I've rented rooms, they took cash. I didn't arrange-in-advance; I just found a motel, told them I needed a room for the night, and gave them cash. At the last one, they were (for no reason apparent to me) all paranoid that I was going to damage their room. A cash "damages deposit", which I got back the next morning, settled them down.
The purpose of a mortar-and-bricks store is to provide a thing you cannot get with online ordering: the ability to see the package, read everything printed on it, and possibly see the gizmo inside, all so that you can more-likely determine in advance whether there's some reason it won't work for your application. That is why I am willing to pay the higher prices charged for in-store purchases versus the lower prices I would pay for ordering it on-line. Charging in-store prices, while giving on-line-ordering experiences just pisses people off.
An advantage accruing to bricks-and-mortar store-owners is that having everything in-stock raises the rate of impulse purchases. There are electronics and computer stores which got plenty of my money via just those sorts of purchases ("Ooooh ... you know, I could use that to ..."), with both parties happy with the purchase outcome.
Looking at a catalogue (printed or web-based) is simply not the same as seeing the item in-person. Catalogue creators typically are not technically-oriented people, and frequently do not know which information should go into an item's description. Does that USB/serial port adapter contain a genuine FTTD chip, or is it some wanna-be knock-off? The catalogue will not say. The photo of the item does not show the small print on the side of the package. Etc.
Multiple tech stores have gone out of business after adopting the 20/80 approach:
* Tandy Radio Shack
* Incredible Universe
* Fry's Electronics
(and possibly in-the-process: Best Buy)
Neighborhood convenience stores (7-11, Circle K, Plaid Pantry, etc.) do well, and don't piss people off, because those stores have, by design, a limited array of items they carry, and people know and expect this. And a Plaid Pantry clerk will never chirp at you, "Would you like to order that on-line?" They either carry a product, or they do not; if they carry it, they have it in-stock.
>The purpose of a mortar-and-bricks store is to provide a thing you cannot get with online ordering: the ability to see the package...
This has become very true of used car sales in the UK. You can buy online through one of the well financed majors or you can seekout a significantly smaller dealership.
The market the majors has created is that the smaller dealerships now only put cars on their forecourts that they have checked, serviced and have a service history and are reasonably confident they can sell and won't be problematic,, as they don't have the reserves or margins to sell a substandard car.
The majors on the other hand, having the benefit of size, reserves and marketing can effectively deliver a car straight from the auctions to someone with minimual inspection and servicing, give the buyer 30 days no fuss trial to find problems... If the buyer does find fault well it is easy to replace with another car on 30 day trial. The customer not suspecting what has gone on will think they are getting really good customer service and so add to the marketing by telling all their friends about the excellent customer service they received from the major...
I'd never use a debit card anyway - that's my money being taken. Even if I get a refund it could still be a nuisance. A credit card has always been my preference since it's the bank's money being taken. I can get the errant transaction(s) cancelled and a new bill issued so that I'm never out of pocket.
> Everyone should get a credit card and pay it in full each month just for the Section 75 of the Consumer Credit Act it offers.
Mea culpa.
I have had a Visa card since 1990 and have used in this way since then. The only hiccup was when the bank reduced the interest free period from 55 days to 30 days (or calendar month) without bothering to tell anyone. The regulatory slipper was eventually well and truly sunk.
Before the advent of debit cards, credit cards (mostly Bankcard and Visa in AU I think) were the only option for purchasing over the phone and for larger purchases when ATMs had quite low daily cash limits well below your CC limit (and no one was very keen on personal cheques.)
I recall purchasing several thousand dollars of home furnishings and whitegoods (from the same store) on my Visa around 2000 for this reason - the alternative of going to a bank branch to withdraw a wad of banknotes wasn't particularly attractive.
The credit card companies always win. Don't forget that they charge vendors fairly hefty fees for the service. Many vendors increase prices to reflect this and some will offer a rebate if you don't use a credit card: such rebates are always more than you'll make in the "interest free" grace period that some countries offer.
Debit card transactions aren't free either. I think they are usually cheaper to the merchant but not free. Now some people might point to that, shout Ah ha! and claim that cash should be used because it's free. Nope. There are costs associated with cash as well. It costs more in employee hours to deal with it and banks often charge businesses for depositing cash.
It's all just a business expense and of three methods cash is the one that's going out of favour. It's a faff for everyone involved.
I never said debit card transactions were free. However, in the EU at least, they're regulated. We allowed the credit card companies to create a duopoly and living with higher charges as a result. Many companies that provide higher value services such as hotels and airlines are happier with the fees as they also indemnify them against fraud or non-payment. But, if the costs are passed on the customer, then they're hardly "the costs of doing business".
Credit cards are a trap.
Sure it's OK if you have a well paid job and plenty of savings and disposable income. But if you live close to break even point, like many people do, then at some point in your life, something unexpected will happen that will cause you to not be able to pay it off one month.
And then you will get hit with charges and interest and it will spiral out of control before you know what has hit you. And then have to start using one credit card to pay off another one, and moving the debt around between providers trying to reduce the interest payments. it will take years to pay that off and cost many times what you borrowed in the first place.
Financial companies are not your friend, however friendly they pretend to be when offering to lend you money. They are heavily regulated because every company in that industry is a shark, and without the regulations they would scam their customers into oblivion. Even with regulation, they have compliance departments whose job is to make sure that they scam their customers to the maximum extent they can get away with before the fines exceed the profits.
Never ever borrow money unless you really need to, and if you do, pay it back as soon as possible.
That's a good policy, but having a credit card isn't incompatible with it. My rule is and has always been that I only put something on a credit card if I will be able to pay the bill in full when it comes due, including if I get no payments between now and then. I might have to move money around to do it, but I have to have that money, and if I don't, I don't buy this thing. Exceptions would require very convincing emergency justification.
It's a risk but one that can be managed through self-control and financial awareness.
I got my first credit card when I enrolled at Polytechnic in the mid 1980s. It's true that most of my later adult life I've been in a well paying job but for the first decade I was not yet I never got into any debt. On occasion I used the credit card to bridge a temporary gap in my finances but I always ensured that I could always cover the cost of the bill by the time it was due.
For the last thirty years my CCs have all been paid off in full by direct debit every month.
Me similarly - except on the odd occasion like the January sales where bargains can be had but the Christmas excesses had drained the bank balance so a one or two month interest hit was acceptable. Timing the payment date to just after payday was the critical factor is you are sailing close to the wind. I always maximised the 25 day interest free credit by paying in full on time.
there are solutions to pay online if not even then basic wire transfer... for years now there are alternatives like BLIK (Poland), Bizum (Spain), iDEAL (Netherlands) and others in basically allow countries in Europe and then work just fine and are quite popular. Of course they are very local so cross border shopping doesn't work but most people buy locally either way. And there is a push to make those system interoperable and also a newcomer Wero... so yeah - you don't need a payment (debit / credit) card to shop online...
And the rest of the world (Brasil, India) is doing their thing to avoid using visa/MC and not be reliant on the whims of very unreliable country...
In the near future economic conditions and financial strictures might make this an unavoidable reality for many.
Even in these comparatively prosperous parts I am noticing more customers waiting for a cash self service checkout at the supermarket and in more struggling locations a much larger proportion of cash checkouts have recently replaced the previously card-only ones.
I guess it's not actually limiting if you cannot purchase what you cannot afford. Of course the underlying problem by then is not credit or credit cards but impoverishment.
Two other factors. Believe it or not there used to be a 500 dollar note. Its gone. And I just saw where 100 dollars today was 11.73 in 1970. So that 500 dollar note in the 70's would have been like walking around with over 4 grand today, 40 hundred dollar bills. So these days carrying cash for a full on grocery run takes 3 hundreds. I've not used in ATM in forever, but not that long ago they dispensed 20's. And I think limited to 200/pull. So you'd have to do 2 pulls just to buy groceries now. And groceries really don't want your paper check anymore.
It pains me to type this, but the reality in the US is the current administration is fine with starving people. SNAP (food stamps) is culling the list. AZ has removed fully 50% of the recipients off. Food banks are running out of food in AZ. SNAP paid via a card, so some of those are going to move to cash. The cash they begged to obtain.
It was for me when Virgin Money/Zurich Travel Insurance fucked me over for a bankrupt Airline whilst in USA - no return flight back to UK.
Tesco Bank paid out in full, inc additional losses incurred on a successful section 75 claim for more than the cancelled flight replacement cost.
Fuck Virgin Money (aka ‘mutual’ Nationwide vast board bonuses and blocking member application for their board money grabbers).
Absolutely.
It's a huge hassle to have to go through Civil Money Claims (or the older Money Claim Online) to get your money back from a business. It takes a long time (14-28 days before claim can start), costs quite a bit in up front court fees (added to the judgement), and some businesses even ignore it entirely until the court rules in their absence 6-10 weeks later.
They usually have 30 days to pay up, and if they don't enforcing the judgement takes even longer - with the ongoing risk that they close down and pretend they have no assets to seize.
Meanwhile Section 75 means the credit card company is jointly and severally liable, so they freeze the transaction immediately over the phone and maybe send you a form and prepaid envelope to sign. The whole thing is usually sorted within six weeks.
So you carry cash around with you everywhere you go?
Yeah that sounds WAY safer than possibly having your credit card number exposed!
I'm sure no checkout clerk or person standing behind noticed you pulling out a big wad of bills to pay for stuff and wondered how easy you'd be to roll in the parking lot...
I don't carry "a big wad of bills to pay for stuff" and flash it about.
When I buy big-ticket items -- which happens rarely -- I use large-denomination bills, and when removing money from my wallet to pay, and while putting change (paper money) into my wallet, I hold my wallet so that people around me have a hard time seeing what is inside.
"Don't flash yer cash."
It's very common for companies that issue recurring bills to use a card account updater (CAU), which is a service provided by the card issuer where the saved credit card details can be automatically updated when the card expires and a new card is issued.
This feature is free with Stripe, while some other payment gateways charge the merchant something like $0.25 per update plus a monthly fee.
Apart from that, some banks (maybe like in your case) continue to allow payments from expired cards if the payment is recognized as a recurring payment from a major merchant.
EU banks will allow recurring payments on expired cards if the first transaction was 3ds secure authenticated, and the merchant sent specific data indicating that this card would be used for scheduled (eg a subscription, so fixed amount, fixed schedule) type payment. It's written into the Payment Services Directive that they must. But they should block payment s on expired cards if it's something like a carpark app, where the amount and frequency are different each time, and they should have set up the first [payment to say that would be the case...
I'm sceptical about expiry dates as well. Some years ago my wife and I spent New Year's Eve in a hotel. The following morning my card was declined when I tried to pay the bill. After a couple of attempts the hotel manager said "let's try this", and pulled out a sheet paper with 'special' codes on it. After entering one on the PoS terminal the transaction went through OK. At home a few days later I realised what the problem was, that card had an expiry date of 31/12. How was the hotel able to override it? No clue. The transaction went through and my bank never queried it.
They mean recurring credit card payments, not bank transfers.
Companies can tokenize your credit card to take payments in the future, for monthly subscriptions or other "save my card details for future purchases"-like features, but banks have no way of telling you which companies have done this.
The Apple express transit mode vulnerability that Veritasium made a video about is also Visa-specific. That vulnerability was that large transactions can be performed by tapping a locked iPhone, with no confirmation and no spend limit, via an MitM attack to make it look like a transit transaction.
I wouldn't be surprised if more Visa-specific security issues get uncovered.
A few years ago my bank card was swallowed by a cashpoint machine which had been tampered with. A small group of 'helpful people' were standing nearby trying to distract me - they didn't.
I stood in front of the cashpoint and phoned my bank. They cancelled the card and said a new one would be issued to me, which arrived a couple of days later.
To my surprise, on my bank statement, the same date my card was swallowed there were a couple of small payments which I did not know about. I contacted the bank, and they said these were contactless payments at a corner-type shop in a part of London that I had never been to. They gave me the times of these transactions - they were an hour or so after I had contacted my bank and they had cancelled my card. My bank acknowledged this and refunded me.
I queried why it was possible for a cancelled card to be used at all. I did not receive a clear or acceptable response. I saw this as a weakness in the bank's system.
So when I read this article, there was a slight sense of deja vu about supposedly defunct cards being able to be used for NFC payments.
"Traditional" digital card payment systems were done daily. The data was consolidated and transmitted to the bank as a batch job, similar to the but faster than the way the old paper system worked. And even after the banks started offering transaction system, they were still backed up with paper systems: if the phone system was down, the retailer could do a paper transaction and submit it later.
So the whole system was originally based on the idea that transactions could be reported later. You can't just use the "time of transaction" as an infallible indicator.
If we could magically teleport back to the planning and design sessions that preceded the release of the first credit card, there's a pretty good chance that fraud prevention was discussed and considered as part of the design. It's also a pretty good bet to say that each of the enhancements we've seen since introduction have been implemented as a balance of cost and risk.
But just by way of a reminder, it's worth noting that the industry has experimented with multiple solutions for much more secure credit/debit card design over the years. For example, in 2009 - so that would be 17 years ago - VISA, Barclaycard and Deloitte ran pilots that included a secure OTP generator built directly in to their cards. See here:-
https://www.finextra.com/newsarticle/20019/deloitte-staff-trial-visa-card-with-built-in-otp-generator-for-it-access-control
And in 2018, Revolut launched "disposable virtual cards" to fight online fraud - with the idea being that every transaction made with the new technology would present a unique but verifiable 16-digit "card number" to the vendor. This meant that even if a vendor's systems were hacked and the data compromised, it could never be re-used because the card number itself was ephemeral.
It's important that we all bear the above in mind when we read articles like this one from Thomas. The Amherst researchers here have been able to exploit vulnerabilities in the world's credit card payment architecture which haven't just been *known about* since at least 2009, but for which we've had robust, effective solutions - since at least 2009.
Now... to bring a bit of balance, if we had a manager from a credit card provider of bank in this chat, they would almost certainly point out that credit cards carry the burden of risk and that anyone is free to dispute a fraudulent charge on their card - and that the industry is doing a great deal to try and kill off the fraud. All of that is true. On the other hand, the UK Finance web site reports:-
https://www.ukfinance.org.uk/news-and-insight/press-release/fraud-report-2026-press-release
... that in 2025 alone, the UK lost £1.28 billion through payment fraud.
That's an important data point, because now we can ask, "Would the cost of issuing UK citizens with more secure credit and debit cards that feature OTP capabilities exceed £1.28 billion per year?"
Given the fact that there are approximately 61 million credit cards in the UK [ https://generationmoney.co.uk/credit-card-statistics/ ] I think it's fair to say that this particular question is going to exist at the most beneficial end of the economies-of-scale spectrum, so any additional costs for production are going to be unit costs and not e.g. design overheads.
The fraud is real.
The costs - which have to be covered by card-users through fees - are eye-watering.
The solutions exist - and have been around for almost 2 decades.
The banks and card companies are doing nothing.
NOTHING.
Why?
Because for as long as they can recover their costs by charging us fees to be defrauded through their incompetence, they're happy.
This is what we have financial regulators and consumer protection laws for.
Not to protect consumers... but to protect the profits of the largest industry players.
One of the reasons why the secure OTP generator systems didn't simply continue is because the encryption schemes became outdated (cracked).
I for one wish that the old OTP generator systems had been replaced with new secure OTP generator systems, but the world went to mobile smartphones instead.
Hmm...
Is that entirely fair? For example, RSA SecurID switched to AES-128 in 2003 - and that is still considered very secure today.
From what I've read in web articles before posting against this piece here at El Reg, the practical limitation was not considered to be the security of the algorithm but the lifespan of the battery in the card itself...
But let's take both of these as challenges and see what we can come up with.
First, the algorithm strength... Today, a typical credit card has a lifespan - validity period - of 3-5 years, depending on the issuer. Turning to your concern about possible compromises of the underlying algorithm, we have to consider whether:-
1. The typical failure rate of an algorithm gives it a viable lifespan of less than 3-5 years. For example, RSA SecurID uses AES-128, which it introduced in 2003 and which has been in place for 23 years. I'm not suggesting we should take that as representative, but it's a good starting point. I'd suggest that the likelihood of an algorithm being compromised against the frequency with which cards are routinely changed suggests that this approach remains a "safe bet" - certainly orders of magnitude more secure than the "static" method used by the card issuers. And, of course, there might be additional techniques that could be "folded in" if required.
2. That a modern card battery could not survive for 3-5 years. That's possibly more of a challenge... A basic digital watch, for example, can expect a battery life of 2-3 years, which is on the short end. However... there are possible solutions we could look to. For example, the "Qi Standard" is a globally accepted standard for wireless charging, from the Wireless Power Consortium... which means that if issuers were to put an RF coil in the cards, they could be charged that way.
So I think there might be reasonable solutions to the problems...
At least as far back as the Second World War, expired code books and crypto keys have been highly desirable targets for infosec attacks.
The more things change, the more they don't. Destroy all sensitive materials during disposal. This includes memory devices. Sorry, iPad old buddy, it's nothing personal. <CRUNCH>
Anon because who wants to be a soft target?
"At least as far back as the Second World War, expired code books and crypto keys have been highly desirable targets for infosec attacks.”
In theory an expired code book and key are completely useless; but like I said - in theory. It assumes that the code book was perfectly, randomly generated etc. In practice, people get lazy, take short cuts.
An equivalent is enforcing a regular password change, if the password changes from ‘sdifhgsdhjgfhj' to ‘pwjlkjbsddsxhv', great - more likely it will change from ‘Password17’ to ‘Password18’. Knowledge of a previous key/code. should not provide any information as to what the current key/code is - reality often gets in the way though!
They had already cracked Enigma, but they did always need to crack the daily settings...
Apparently the guy was at a remote outpost in N Africa, who would set up his Enigma, enter the daily settings, encode his message ('nothing to report') and fire it off to HQ.
Bletchley loved him because they knew the contents of the message and that meant it cut the time to crack the settings dramatically... for the N Africa zone
(for other zones they would have to rely on things like routine and guessing that a message at 7am would start 'here is the weather for...')
Surely the bank doesn't need to carry out any security checks, if the card is expired, it should have a flag set against it saying its expired. The very first thing checked when authorising a payment should be that flag. Why even waste time checking signatures etc if the bank knows a card is expired, which it should know.
Card numbers are generally re-used on expiry - generally a predictable new expiry date is assigned and a new CVV is set at most.
Changing a card number on expiry would mean that card details need to be updated with all disservices on expiry, which businesses who don't have access to the API that gives them the new card number, don't want to happen.
Also, there isn't that many card numbers available - assigning a unique new number every expiry may not be feasible, many of the numbers are fixed per card processor and without adding several more numbers, old card numbers would likely end up being reassigned to someone else.
After all, it seems that most card numbers stay the same and if an expired card is found, it's trivial to guess the new expiry date - as I would expect;
expiry year = old expiry year + renewal term
expiry months = old expiry month + 0-3 months
Many card terminals allow putting a transaction through with only the card number and expiry date.
Even if both the correct new expiry date and the correct new CVV is required as well, that's an easy to guess date and only 3-4 numbers, so with a payment service that is processing a lot of "legitimate" transactions - what would stop credit card fraudsters from turning a pile of expired credit cards or expired card number/expiry pairs into successful fraudulent transactions?
Many subscription dis-services even seem to have the ability to charge a charge a card number alone and also get sent the new card number if it's changed - I've read allegations that such functionality is used to ensure "accidentally setup" $1/month etc transactions to keep going even if the card is cancelled and a new card is ordered.
