Recent research has unveiled a significant vulnerability in expired Visa credit cards that allows them to still process contactless transactions. This discovery was made by a team from the University of Massachusetts Amherst and was presented at the 35th USENIX Security Symposium. The study details how a near-field communication (NFC) relay attack, named ‘Zombie Card,’ can enable contactless payments with expired cards.
Understanding the EMV Contactless Payment Flaw
The vulnerability arises from how EMV contactless payments handle card expiration. Unlike what many might believe, the expiration check is not cryptographically enforced on the card itself. Instead, it is a transaction policy check performed by the terminal. This means that the expiry data is read and validated locally, leaving room for manipulation.
Private keys in the card’s chip do not expire, and certificates used for card authentication remain valid beyond the printed expiration date. The expiry is determined by the Application Expiration Date field, which is checked in plaintext by the terminal.
How the Zombie Card Attack Works
Researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza demonstrated the attack using two NFC-enabled Android phones. One phone emulates the card at the point-of-sale (POS) terminal, while the other emulates the terminal near the physical card, communicating over Wi-Fi. This setup allows the interception and rewriting of Application Protocol Data Units (APDUs) during the transaction in real-time.
Their tests across various EMV kernels showed that most detected tampering through cryptographic means, except for Kernel 3, used by Visa. This kernel’s expiration field isn’t part of the signed data, allowing an expired date to be changed to a future date without triggering security alerts.
Implications and Proposed Solutions
The research highlighted that some banks unknowingly processed these ‘zombie transactions,’ with one bank approving payments up to $500 as long as the account and cryptogram were valid. The researchers suggested several countermeasures, such as binding expiry data to signed records and ensuring consistency checks between terminal and issuer data.
They disclosed their findings to Visa and affected banks in May 2025. However, as of the time of their report, no fixes had been confirmed. Cardholders are advised to destroy expired cards completely to prevent misuse.
While the industry works towards systemic changes, individuals should remain vigilant and follow recommended practices to safeguard against potential fraud arising from this vulnerability.
