diff --git a/package.json b/package.json
index 41e57d9..b4b6529 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@discolabs/submarine-js",
-  "version": "0.0.18",
+  "version": "0.0.19",
   "description": "Javascript client library for Submarine.",
   "main": "index.js",
   "author": "Gavin Ballard",
diff --git a/src/checkout/payment_methods/shop_payment_methods/cybersource_credit_card_shop_payment_method.js b/src/checkout/payment_methods/shop_payment_methods/cybersource_credit_card_shop_payment_method.js
index 9b68a9f..c9ba3ca 100644
--- a/src/checkout/payment_methods/shop_payment_methods/cybersource_credit_card_shop_payment_method.js
+++ b/src/checkout/payment_methods/shop_payment_methods/cybersource_credit_card_shop_payment_method.js
@@ -16,6 +16,8 @@ const CYBERSOURCE_CARD_TYPE_MAPPINGS = {
   forbrugsforeningen: null,
 };
 
+const MAXIMUM_FUTURE_EXPIRY_IN_YEARS = 15;
+
 export class CybersourceCreditCardShopPaymentMethod extends ShopPaymentMethod {
 
   beforeSetup() {
@@ -66,7 +68,7 @@ export class CybersourceCreditCardShopPaymentMethod extends ShopPaymentMethod {
       },
       expiry: {
         value: expiry,
-        valid: payform.validateCardExpiry(expiry.month, expiry.year)
+        valid: this.isValidExpiry(expiry.month, expiry.year)
       },
       cvv: {
         value: cvv,
@@ -99,6 +101,16 @@ export class CybersourceCreditCardShopPaymentMethod extends ShopPaymentMethod {
     return !!cardType && (['visa', 'mastercard', 'amex', 'discover'].indexOf(cardType) !== -1);
   }
 
+  isValidExpiry(month, year) {
+    if(!payform.validateCardExpiry(month, year)) {
+      return false;
+    }
+
+    // Payform does not enforce any maximum future expiry, so we add our own here.
+    const currentYear = new Date().getFullYear();
+    return year < (currentYear + MAXIMUM_FUTURE_EXPIRY_IN_YEARS);
+  }
+
   displayValidationErrors(state, errors) {
     this.$cardNumber.closest('.field').toggleClass('field--error field--submarine-error', !state.number.valid);
     this.$cardName.closest('.field').toggleClass('field--error field--submarine-error', !state.name.valid);