Expired Visa Cards Can Be Resurrected for Contactless Payments in "Zombie Card" Attack

Researchers at the University of Massachusetts Amherst have demonstrated a method to revive expired Visa contactless credit cards for real in-store purchases by exploiting a gap in how point-of-sale terminals read expiration data over NFC.

The attack — named "Zombie Card" — does not break any of the card's cryptography. Instead, it exploits a structural flaw in Visa's contactless payment protocol that has quietly persisted while billions of tap-to-pay transactions occur daily. For consumers and financial institutions alike, the implications are significant: an expired card sitting in a drawer or a recycling bin may not be as harmless as it appears.

---

How the Zombie Card Attack Works

The attack requires physical possession of an expired card or sustained NFC proximity to it. It also requires a man-in-the-middle relay positioned between the card and the payment terminal. Crucially, the account must remain open under the same primary account number — a standard condition when an issuer sends a replacement card.

Lead author Raja Hasnain Anwar, a doctoral candidate with the Khwarizmi Lab at UMass Amherst, explained the core vulnerability in plain terms. "Yet it is not cryptographically protected. So we can easily modify it to fool the POS," he said of the expiration date in a university release.

The Architectural Split Visa's Protocol Relies On

The attack targets a specific architectural split in how Visa contactless transactions handle expiry data. The expiration date appears twice in a Visa contactless transaction, and the two representations are consumed by different parties:

• The terminal evaluates its processing restrictions against the Application Expiration Date in TLV tag 5F24
• The issuer derives the expiry from Track 2 Equivalent Data in tag 57

According to the paper, Visa's Kernel 3 does not require these two representations to be consistently bound. More critically, the fast Dynamic Data Authentication signature that the terminal verifies excludes tag 5F24 entirely. A relay device simply rewrites the terminal-facing date to any future value and leaves Track 2 untouched — meaning the card's signature and its issuer-verified cryptogram both continue to validate.

Relay Hardware and Timing

The relay itself consisted of two NFC-capable Android phones running custom software over Wi-Fi and was tested against SumUp Solo and SumUp Plus readers. Each transaction round trip added an estimated 20 milliseconds for relay and 50 milliseconds with modification, resulting in a per-transaction average of roughly 415 milliseconds — well within the EMV command limit of 500 milliseconds.

None of the physical cards or terminals in the testbed implemented EMV's optional Relay Resistance Protocol, which would have detected the added latency. Understanding how these relay mechanics intersect with broader mobile and contactless payment technologies helps frame why this gap has gone unaddressed for so long.

---

What the Bank Tests Revealed

The research team tested five major US banks in a preliminary study examining general EMV transaction tampering. Three of those banks were then tested specifically with expired and replaced physical cards. The results were not uniform.

Bank-by-Bank Outcomes

• Bank A allowed the expiration date to be modified and accepted transactions from more than one card simultaneously
• Bank B detected the modification but accepted transactions from only one active card — with the issuer ultimately declining each transaction and prompting the cardholder to use the replacement card
• Bank D, whose cards ran Discover's kernel, detected the modification but still accepted transactions from more than one card

Against Bank A, the revived card completed transactions of $1.00, $100.00, and $500.00 on the researchers' own terminal, as well as $2.79 at a retail merchant and $3.19 at a grocery merchant on campus. The research team conducted all testing on their own accounts.

A Secondary Exposure: Dual-Card Overlap

The findings also exposed a separate issue. One card in the test set had been automatically replaced by its issuer for having under three months of validity remaining. Anwar noted that for the period before the first card's own expiration date, both it and its replacement were able to make transactions against the same account without any modification.

This dual-card window represents a discrete and underappreciated fraud exposure — one that exists entirely within normal card lifecycle management, requiring no technical manipulation at all.

Anwar told The Hacker News that the divergence between bank policies matters more than any single outcome. "There is no consensus in the industry as to what is the safe way to handle expiring cards," he said. "Every bank and payment network sets its own priorities and is therefore exposed to a different type of attack."

The inconsistency in bank responses underscores a wider problem that online and in-person payment fraud risks share: fragmented defences create uneven exposure across the same payment infrastructure.

---

Industry Response, Countermeasures, and What Comes Next

Disclosure Timeline and Current Status

The research was presented at the 35th USENIX Security Symposium in Baltimore from August 12 to 14, 2026. Anwar, Gerard DeCunha, and Muhammad Taqi Raza disclosed the findings to Visa and the affected banks in May 2025 and followed up in December 2025. No CVE has been assigned and no exploitation of the technique has been publicly reported.

As of August 20, 2026, no advisory or mitigation guidance has been published by Visa, EMVCo, Mastercard, Discover, American Express, or terminal vendor SumUp. The paper notes that Visa's report passed initial triage and is undergoing reproduction by Visa's red team, but that "neither Visa nor the notified banks has provided any update on the status or nature of mitigations." Visa had not responded to a request for comment at the time of writing.

Four Proposed Technical Countermeasures

The paper proposes four technical countermeasures that payment networks and issuers could act on independently of one another:

1. The Application Expiration Date and cardholder verification fields should be cryptographically bound to an issuer-verifiable signature
2. Terminals should compare both expiry representations and flag mismatches
3. Issuers should treat the presented expiry as part of the credential identity and decline where it does not match the valid credential for that account number
4. Expiry-related terminal outcomes should be made visible to the issuer rather than zeroed out

These proposals are architecturally straightforward. Their absence from current specifications reflects a protocol design era in which expiry was treated as a convenience check rather than a security boundary — an assumption the Zombie Card attack directly invalidates. Mandatory cryptographic binding of all expiration data would close this class of attack entirely.

For organisations operating under payment security frameworks, these findings add weight to the case for rigorous implementation of controls — a standard that PCI DSS compliance requirements for payment security are designed to enforce, even if the specific gap exposed here sits at the protocol level above what PCI DSS directly governs.

WindRelay: A Parallel Threat in the Wild

The findings arrive alongside a separate report from Singapore-based Group-IB documenting WindRelay, a previously unseen Android NFC relay malware family deployed in live social engineering attacks across Czechia, Slovakia, and Slovenia. That malware relays an active card in real time using the same two-device relay primitive the Zombie Card testbed depends on.

"This case shows that modern fraud rarely relies on one technique," Group-IB stated in its report published August 12, 2026. The convergence of an academic proof-of-concept and active in-the-wild malware using the same underlying mechanism should accelerate urgency around Relay Resistance Protocol adoption — a control that terminal vendors have long had the ability to implement but have not been required to deploy. For further technical detail on WindRelay, Group-IB's published threat intelligence provides ongoing reporting on NFC-based fraud campaigns.

What Cardholders and Institutions Should Do Now

For everyday cardholders, the researchers recommend:

• Physically destroy the chip and magnetic stripe of expired cards rather than discarding them intact
• Continue monitoring accounts even after a card's printed expiration date has passed, particularly during the overlap window when a replacement card has been issued

For financial institutions and merchants, the findings provide concrete grounds to pressure payment networks for cryptographic binding of all expiration data and to advocate for mandatory implementation of Relay Resistance Protocol across terminal hardware — a relatively straightforward upgrade that would have blocked the relay component of this attack entirely.

The Zombie Card attack does not require a sophisticated adversary. It requires an expired card, a relay, and a terminal ecosystem that has not yet closed a gap it has known about long enough to fix.