Researchers at the University of Massachusetts Amherst have identified a vulnerability, dubbed "Zombie Card," that allows expired contactless credit cards to be used for unauthorized payments. The team, led by Muhammad Taqi Raza, assistant professor in the Riccio College of Engineering, presented their findings at USENIX Security 2026. The issue stems from a disconnect in how various components of the payment ecosystem verify card validity.
The research was prompted by the observation that credit card accounts do not expire with the physical card, allowing refunds to be processed even after a card's printed expiration date. This led Raza to investigate whether an expired card could also initiate a payment. Working with Raja Hasnain Anwar and Gerard DeCunha, the team confirmed this was possible for certain card configurations.
The "Zombie Card" attack exploits a lack of effective integrity protection in some contactless payment systems. The researchers demonstrated a relay attack using two ordinary smartphones equipped with near-field communication (NFC) capabilities. One phone activates the expired card to extract its payment data, including the outdated expiration date. A second phone, linked via Wi-Fi, intercepts this data, modifies the expiration date to a future date, and then transmits it to a point-of-sale (POS) terminal. Anwar noted that an attacker does not need the correct future date, as almost any future date will suffice, and the expiration date is not cryptographically protected in the vulnerable systems, making it easy to alter.
The team found that Visa contactless transactions were susceptible to this man-in-the-middle tampering. In contrast, tests against Mastercard, American Express, and Discover configurations showed these systems rejected altered dates because their cryptographic checks incorporate the expiration data, which would be broken by tampering.
The behavior of the cardholder's bank also played a significant role. With one major US bank, the modified expired card successfully completed purchases of $1, $100, and $500 in lab tests, and also live retail and grocery purchases of $2.79 and $3.19. This bank's systems reportedly only confirmed the existence of the account and the active status of the card number, without verifying if the specific card instance and its expiration date were still on file. A second bank, however, consistently declined transactions using the same trick, prompting cashiers to request the replacement card.
A contributing factor to the vulnerability in Visa's Kernel 3 is that the field typically used to flag an expired card to the issuer is reset to all zeros before being sent, preventing the bank from seeing that the terminal's own check would have failed. Additionally, cards often carry a second expiration date embedded in their digital certificates, which can be valid well beyond the printed date to accommodate renewal periods.
The researchers also uncovered a related issue concerning card replacements. In their tests, a card that had not yet reached its printed expiration date but had been automatically replaced due to having less than three months of validity remaining continued to function alongside its replacement on the same account. This suggests that replaced cards are not reliably deactivated, similar to expired ones.
The researchers disclosed their findings to Visa and the affected banks in May and December 2025, providing a reproduction guide, transaction records, and a demo video. Visa acknowledged the report and stated it was being reproduced by their red team, but neither Visa nor the banks had confirmed a fix by the time of publication. No CVE has been assigned. The team withheld the relay code to prevent its misuse for fraud, instead publishing sanitized logs and protocol details.
Proposed solutions include binding the expiration date to a cryptographic check, similar to how rival payment networks operate, ensuring banks receive information about the terminal's own card validity checks, and requiring issuers to verify the specific card and expiration date on file rather than just the account number. The researchers advise cardholders to always destroy expired cards and to monitor transaction activity even on closed accounts.
