Zombie Card Attack Revives Expired Visa Cards for Contactless Fraud

Researchers at the University of Massachusetts Amherst have demonstrated a "Zombie Card" attack that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale terminal reads over NFC — without breaking any of the card's cryptography. The technique requires physical possession of the expired card or sustained NFC proximity, plus a man-in-the-middle relay positioned between the card and the terminal. It also relies on the account remaining open under the same primary account number, which is standard practice when issuers send a replacement card, and on the issuing bank failing to independently re-check the expiry during authorization.

Lead author Raja Hasnain Anwar, alongside Gerard DeCunha and Muhammad Taqi Raza, disclosed their findings to Visa and affected banks in May 2025, with follow-up contact in December 2025. Their preliminary study tested five major US banks, and transactions succeeded at most of them when the team modified the Consumer Device Cardholder Verification Method (CDCVM) flag — a result Anwar called alarming because it rests on the same weakness the expiry attack exploits: undetected transaction modifications. Three banks were then tested with expired and replaced physical cards, revealing three distinct policies. Bank A allowed the expiration date to be modified and accepted transactions from multiple cards simultaneously. Bank B detected the modification and accepted only one active card. Bank D, whose cards ran Discover's kernel, detected the modification but still accepted multiple cards. The work was presented at the 35th USENIX Security Symposium in Baltimore from August 12–14, 2026.

The vulnerability stems from a critical inconsistency in how Visa's Kernel 3 handles expiration data. Card expiry appears twice in a contactless transaction: the terminal evaluates processing restrictions against the Application Expiration Date in TLV tag 5F24, while the issuer derives the expiry from Track 2 Equivalent Data in tag 57. According to the paper, these two representations are not consistently bound, and the fast Dynamic Data Authentication (fDDA) signature the terminal verifies excludes tag 5F24 entirely. This allows a relay to rewrite the terminal-facing date to any future value while leaving Track 2 untouched, letting the issuer authorize a transaction it believes is still in-date. As of August 20, 2026, no CVE has been assigned and no advisory, specification bulletin, or mitigation guidance has been published by Visa, EMVCo, Mastercard, Discover, American Express, or terminal vendor SumUp.

With contactless MitM relay kits becoming cheaper and more accessible, consumers and merchants should harden their payment environment. Run a privacy checkup on the devices used for mobile payments to ensure no rogue apps are intercepting NFC traffic, and verify your network integrity with a DNS leak test to confirm no malicious proxies are redirecting authorization requests. Retailers and payment processors should validate terminal-to-acquirer communication with an SSL/TLS checker to confirm transport-layer encryption is properly configured against relay tampering.