Researchers have reportedly developed a novel attack, dubbed "Zombie Card," capable of reactivating expired Visa contactless payment cards for in-store transactions. This method reportedly allows an attacker to bypass the expiration date check during a transaction, effectively enabling the use of otherwise invalid cards.
The core of the Zombie Card attack is described as a man-in-the-middle (MitM) relay. In this setup, an intermediary device intercepts communication between an expired Visa contactless card and a point-of-sale (POS) terminal. The relay then reportedly modifies the expiration date information presented to the POS terminal, making the expired card appear valid for the transaction. Crucially, the attack is said to leave the card's underlying cryptographic elements untouched, suggesting that the transaction still leverages the legitimate card's security features, only with an altered validity period.
This technique specifically targets Visa contactless cards, which are widely used for tap-to-pay transactions globally. The reported success against "some major US banks" indicates that the vulnerability may stem from how certain issuing banks or payment processors validate card expiration dates during contactless transactions, rather than a flaw in the card's cryptographic security itself. The fact that it was "not universally" successful suggests variations in implementation or security controls across different financial institutions.
The attack mechanism highlights a potential discrepancy in how expiration dates are enforced within the contactless payment ecosystem. While the card itself is expired, the MitM relay reportedly manipulates the data stream to present a valid date to the terminal. This suggests that the terminal's initial check for validity might be susceptible to manipulation if not adequately cross-referenced or cryptographically protected against such alterations.
Mitigation for this class of issue typically involves robust validation at multiple points in the transaction chain. Issuing banks and payment networks often employ server-side authorization checks that independently verify card validity, including expiration dates, against their own records. Strengthening these server-side checks and ensuring that POS terminals are not solely reliant on the card's presented expiration date, particularly in contactless scenarios, could help address such vulnerabilities.
This research underscores the ongoing challenges in securing contactless payment systems, even as they become increasingly prevalent. While the underlying cryptography of payment cards is generally robust, the peripheral mechanisms and data handling processes, such as expiration date validation, can introduce new attack vectors. It emphasizes the need for continuous security assessments and layered defenses across the entire payment ecosystem to protect against evolving threats.
