PIN bypass, card cloning and replay attacks threaten EMV contactless payment security

The contactless interface, meant to enhance convenience, opens the door to inconspicuous man-in-the-middle (MITM) and relay attacks using tools as accessible as two NFC-enabled smartphones. In several cases, adversaries successfully relayed transactions from a victim’s card or phone without detection. Replay attacks, wherein previously captured transaction data is reused to initiate unauthorized payments, remain viable due to inadequate nonce validation and poor randomness in terminal-generated data.

Researchers have revealed critical and previously underappreciated weaknesses in the EMV contactless payment system, calling into question the integrity of one of the world's most widely used financial protocols. Despite processing 94% of card-present transactions across 12.8 billion EMV cards globally, the system remains dangerously exposed to a wide range of real-world attacks, many of which require minimal sophistication to execute.

The findings come from a comprehensive systematization of knowledge (SoK) study titled "SoK: Attacks on Modern Card Payments", conducted by experts from ETH Zurich and SIX Digital Exchange and published on arXiv this week. The review consolidates a decade’s worth of security analyses, revealing 20 critical flaws and more than a dozen practical attacks that exploit systemic design gaps in the EMV contactless protocol. The study dissects both technical failings and governance oversights that continue to endanger payment ecosystems worldwide.

How do attackers breach EMV contactless systems?

The researchers categorize the attacks into seven classes: card cloning, replay attacks, PIN guessing, denial-of-service (DoS), PIN bypass, downgrade attacks, and fraud-induced merchant liability. The most alarming insight is that nearly all documented attacks exploit the same critical flaw, poor or missing data authentication.

The contactless interface, meant to enhance convenience, opens the door to inconspicuous man-in-the-middle (MITM) and relay attacks using tools as accessible as two NFC-enabled smartphones. In several cases, adversaries successfully relayed transactions from a victim’s card or phone without detection. Replay attacks, wherein previously captured transaction data is reused to initiate unauthorized payments, remain viable due to inadequate nonce validation and poor randomness in terminal-generated data.

Card cloning attacks extend this threat. Researchers demonstrated how adversaries can extract magnetic stripe-equivalent data from EMV contactless cards and encode it onto fake cards to carry out fraudulent transactions. Despite updates in EMV specifications, mag-stripe compatibility remains widespread and exploitable. Attacks such as the Magnetic Stripe Cloning exploit legacy compatibility as a backdoor into the payment infrastructure.

Why do protocol weaknesses persist despite industry oversight?

A striking conclusion of the study is that EMV’s complexity and fragmented implementation prevent unified, enforceable standards. The EMV protocol spans over 2,500 pages of technical documentation, includes at least eight protocol variants (or kernels), and permits numerous configuration options for issuers and merchants. This technical sprawl has led to inconsistent security enforcement and implementation gaps across different vendors and regions.

Visa and Mastercard, for instance, use different cryptographic mechanisms and default behaviors for transaction authentication. As a result, some critical fields such as Card Transaction Qualifiers (CTQ) and Terminal Transaction Qualifiers (TTQ) remain unprotected in certain configurations, enabling attacks like PIN bypass by falsifying verification data.

One such exploit, the “Card Brand Mixup Attack,” allows adversaries to trick terminals into using the Visa kernel to process a transaction from a Mastercard card, circumventing security policies that apply to Mastercard transactions. This and other related exploits highlight a core issue: terminals and cards can be manipulated to disagree on transaction logic, which adversaries then exploit to bypass authentication mechanisms.

The lack of mandatory authentication for vital transaction data points, like the Cardholder Verification Method (CVM), Application Identifier (AID), and terminal behavior flags, has enabled attacks that bypass PIN entry requirements, spoof card presence, and even allow high-value transactions without proper authorization.

What steps can strengthen EMV contactless security?

The study does not only enumerate attacks, it proposes a strategic path forward. The authors advocate for widespread adoption of formal verification methods to test and certify EMV configurations and implementations against defined security properties. Formal tools like the Tamarin Prover were highlighted for their effectiveness in detecting vulnerabilities and verifying the success of proposed fixes.

Researchers also underscore the need for stronger policy enforcement and better issuer behavior. For instance, many issuers still fail to validate transaction counters or perform adequate risk analysis during transaction approval, enabling out-of-order and replayed transactions. Industry-driven mitigations such as Mastercard’s decision to begin matching AIDs with card numbers following prior disclosures, represent reactive rather than preventative measures.

There is also an urgent call for deprecation of legacy components like magnetic stripes, which continue to expose users to avoidable risk. Despite announcements from Mastercard to phase out mag-stripe cards, they remain active across global markets in 2025.

The study recommends coordinated standardization of secure transaction behaviors across all EMV kernels, robust protection of all protocol-critical fields, and implementation of real-time fraud detection systems that consider relay patterns and PIN bypass anomalies. It also stresses the importance of transparency: the EMV ecosystem should adopt more open evaluation processes to allow independent researchers to contribute to the protocol’s improvement without legal or commercial hindrance.