Full Breakdown
Zombie Card Attack Revives Expired Contactless Credit Cards
8/20/2026, 10:05:10 PM
Core Event: Expired Cards Used for Fraudulent Purchases
On August 18, 2026, researchers from the University of Massachusetts Amherst presented a proof-of-concept attack at the USENIX Security conference. Led by doctoral candidate Raja Hasnain Anwar, assistant professor Muhammad Taqi Raza, and researcher Gerard DeCunha, the team showed that an expired contactless credit card can be coaxed into completing a point-of-sale (POS) transaction. Using two smartphones, the first reads the card’s NFC data, relays it over Wi-Fi to a second phone, which rewrites the stored expiration date before forwarding it to the terminal. The modified data passes the terminal’s checks, allowing purchases of up to $500 in laboratory tests and live transactions of $2.79 and $3.19 at retail merchants.
Background & Context: How Contactless Payments Verify Expiration
Contactless payments follow the EMV protocol, which splits verification across the card chip, the POS terminal, the payment network’s kernel, and the issuing bank. The card’s expiration date appears in two fields: the Application Expiration Date read locally by the terminal, and a separate date transmitted to the issuer during online authorization. In Visa’s Kernel 3 implementation, the terminal-read date is not cryptographically bound to the card’s digital signature, and the field is reset to zeros before being forwarded to the issuer. Consequently, an attacker can alter the date without breaking the card’s overall cryptographic checks. Mastercard, American Express, and Discover kernels bind the expiration field to a signature, causing the same manipulation to be rejected.
Data & Statistics: Test Results Across Networks and Banks
- Visa contactless cards: susceptible; transactions of $1, $100, and $500 succeeded in lab conditions.
- Live retail tests: purchases of $2.79 and $3.19 succeeded.
- Mastercard, American Express, Discover: rejected the altered date in all trials.
- Bank behavior: one major U.S. bank allowed the modified card to complete purchases, while a second bank declined every attempt.
Official Statements & Responses
The research team disclosed the vulnerability to Visa and the affected banks in 2025, providing a reproduction guide, transaction logs, and a demo video. Visa’s internal report entered initial triage and was reproduced by its red team, but as of the August 2026 publication, neither Visa nor the banks had confirmed a remediation. No Common Vulnerabilities and Exposures (CVE) identifier had been assigned.
Conflicting Reports & Gaps
Sources agree that Visa’s kernel permits the attack while other networks block it. The precise criteria used by individual banks to accept or reject the modified transaction are not fully disclosed, leaving a gap in understanding how issuer-side checks vary across institutions.
Why It Matters / Impact
The attack exposes a systemic risk for jurisdictions where contactless Visa cards dominate retail payments. Because the underlying account remains active after card replacement, a discarded card can continue to drain funds if an attacker possesses the plastic and two smartphones. The vulnerability highlights the broader challenge of fragmented security checks across the payment ecosystem, where each participant trusts the others without re-validating critical fields such as expiration dates.
What’s Next
Mitigation requires Visa to bind the expiration date to the card’s digital signature and to mandate that issuing banks re-verify the exact card instance during online authorization. As of the latest disclosures, no definitive fix has been implemented, and the research community continues to monitor for real-world exploitation. Consumers are advised to destroy expired cards by cutting the chip, magnetic stripe, and printed numbers, and to prefer tokenized digital wallets (e.g., Apple Pay, Google Pay) that do not expose the raw card data.
