Researchers at the University of Massachusetts Amherst have revealed a novel method, termed the ‘Zombie Card’ attack, which allows expired Visa contactless cards to be used for transactions. This technique involves altering the expiration date read by point-of-sale (POS) terminals via near-field communication (NFC), all without compromising the card’s underlying cryptographic protections.
Mechanics of the Zombie Card Attack
The attack necessitates physical access to the expired card or a sustained NFC connection to it. A man-in-the-middle (MitM) relay device is employed between the card and the terminal to modify the expiration date information. For this attack to succeed, the account must remain active with the same primary account number (PAN), which is typical when banks issue replacement cards. Additionally, the issuing bank must not verify the expiration date during the transaction authorization process.
In their study, the researchers evaluated the attack across five major US banks. They found that one bank’s system approved transactions with revived cards, while another rejected all attempts. A different Europay, Mastercard, and Visa (EMV) kernel used by a third bank failed to process the modified transactions altogether.
Security Symposium and Industry Response
The findings were shared at the 35th USENIX Security Symposium held in Baltimore in August 2026. The research team, comprising Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza, disclosed their results to Visa and the affected banks in May 2025, with a follow-up in December 2025. As of the latest update, no Common Vulnerabilities and Exposures (CVE) identifier has been assigned, and there have been no reports of the technique being exploited in the wild.
The researchers noted the absence of any advisory or mitigation guidance concerning this vulnerability from Visa, EMVCo, Mastercard, Discover, American Express, or terminal vendor SumUp as of August 2026.
Technical Details and Mitigation Strategies
Visa contactless transactions involve two separate expiration date representations, which are processed by different systems. The terminal uses the Application Expiration Date, while the issuer assesses the expiry based on Track 2 Equivalent Data. Visa’s Kernel 3 does not require these dates to be consistently linked, allowing the attack to succeed by altering only the terminal-facing date.
The researchers propose several countermeasures, including cryptographically binding expiration-critical data and ensuring that terminal validation results are communicated to issuers. They also suggest that issuers should treat the expiration date as part of the credential identity, declining transactions where the date does not match the valid credential for the PAN.
Future Implications and Industry Developments
The Zombie Card attack underscores the complexities of maintaining security in contactless payment systems. While researchers have not released the MitM implementation, sanitized transaction logs have been made available, highlighting the need for caution in disseminating potentially harmful techniques.
Concurrently, Group-IB has identified a new Android NFC relay malware named WindRelay, which operates similarly by relaying active card data in real-time without altering expiration dates. This development emphasizes the evolving nature of fraud techniques in the digital payment landscape.
