Card expiry data is the month and year printed or stored on a payment card that tells a terminal whether the card should still be accepted. In card-present and contactless payments, expiry is one of the basic lifecycle checks used to reject lost, old, or otherwise invalid cards before authorization continues.
It matters because expiry is not just a date field; it is a control point in the payment flow. If a terminal, reader kernel, or backend service validates it too late, too loosely, or in the wrong place, an expired card may be treated as valid long enough to complete a tap-to-pay transaction. Attackers look for these logic gaps, while defenders test them by checking how different terminals handle expired cards, offline mode, and edge cases in EMV contactless processing.