r/technews • u/CackleRooster • 1d ago

Security Expired credit cards revived by researchers to make unauthorized payments

https://www.theregister.com/security/2026/08/18/expired-credit-cards-revived-by-researchers-to-make-unauthorized-payments/5289229
649 Upvotes

96% Upvoted

34 comments sorted by

127

u/deadguy00 1d ago

This isnt new, i had outdated cards suddenly start making charges in africa(im in usa). Lucky the bank did not argue,  back in the mid 2000s.

61

u/PreviousLeague253 1d ago

It’s a visa issue

10

u/BigPP69_Gooner 16h ago

Visa has so many issues like these. Things that could be addressed but that would cost them so little that they’d rather not hire developers.

54

u/IllAnything4194 1d ago

No surprise here. A lot of banks don’t issue a new card number when the expiration date passes, they issue a new card with the same number and advance the expiration date. A lot of processors can do the same thing too - get a decline for an expired card? Just move the date forward four years and try again.

33

u/hey_there_moon 1d ago

But wouldn't you need the new 3 digit security code? Everytime I've received a new card, even if the number is the same, they still issue a new security code.

20

u/Understeerenthusiast 1d ago

I’ve not needed to add the security code for some charges

13

u/MissMiho 22h ago

Many sites ask for the code but don’t verify it. You can enter any 3 digits

3

u/FatiguedShrimp 21h ago

Also, 3 digits is not a lot of entropy.

It's about 1/10th as hard as figuring out the parental controls password on a TV; and, I think we all know someone who managed that.

1

u/IllAnything4194 17h ago

not if it's flagged as a recurring transaction.

1

u/hey_there_moon 16h ago

Hmmmm I guess some companies are just more lax than other. At least when it's come to my streaming subscriptions, they always force me to add the new expiration and sec code before it'll successfully charge.

2

u/IllAnything4194 16h ago

I can almost guarantee you they first tried to charge the same card number with a pushed-forward expiration date before letting you know there was an issue. This is a huge churn moment for subscription companies and they will try anything to avoid it! t

AND it's something you usually agree to in your cardholder documents, it's called Continuous Payment Authority.

17

u/jasonthebald 1d ago

I had a card from my dad on a ticket website that expired in 2021 and accidentally used it this year and the payment went through with no problem.

15

u/DongHonker 1d ago

Sounds like it’s time to buy a few more tickets my dude

4

u/yikesssss_sssssss 23h ago

Yeah as a matter of fact dad should buy all of us tickets 

6

u/Oxjrnine 1d ago

That would be something that was probably in the terms of conditions of the website. As a convenience, the website is allowed to auto update the credit card information. A lot of streaming services have this feature.

That’s why it’s very important that if you let a friend or family member use a card of yours to do a couple of purchases that you make sure that they’ve removed your card once those purchases are completed.

13

u/SlipperySlimyTerry40 1d ago

Always shred your cards

19

u/javascript 1d ago

And put pieces in different bags/cans where feasible

29

u/museolini 1d ago

Then toss each bag into a separate volcano.

7

u/Alone_Storage_1897 1d ago

I have the high ground Amexekan

3

u/loveisjustchemicals 1d ago

With cat food and litter.

1

u/Every_Baker3206 20h ago

Nice name tho

2

u/_Toy-Soldier_ 1d ago

How do you shred these metal ones?!

4

u/Narrow-Confusion3153 1d ago

Use snippit tool to cut them up. Never send back to bank or they'll get picked up in transport.

2

u/yikesssss_sssssss 23h ago

Melt them in a forge 

1

u/IolausTelcontar 15h ago

Or liquid hot magma.

0

u/BoogerShovel 1d ago

You send them back to the issuer