An expired bank card should be exactly that: expired. Once you’ve received its replacement, the old card should no longer be useful for making purchases. At least, that’s the assumption most of us make. Researchers at the University of Massachusetts Amherst have now demonstrated a technique that unexpectedly challenges that. It’s dubbed, the “Zombie Card” attack… the biggest irony is that it has a pretty cool sounding name, despite the reality of what it is.
Despite that, this attack doesn’t work by breaking Visa’s encryption or somehow cracking the card’s security.
Instead, the researchers found a weakness in how the card’s expiry date is handled during a contactless transaction.
To understand the problem, it helps to look at what happens when you tap a contactless card, in English, and not technobabble:
The researchers discovered that these two values aren’t sufficiently bound together cryptographically. In plain terms, it means the system separates what the payment terminal checks from what the issuing bank verifies, and does not use mathematics to lock the two together. This allows an attacker to manipulate data inputs to bypass expiry checks. [Source]
An attacker positioned between the card and the payment terminal can intercept the communication and change the expiry date the terminal sees. For example, an expired card could tell the terminal that it expires in 2028 rather than 2026.
The important part is that the underlying security checks can still succeed because the manipulated expiry date isn’t included in the data protected. So, if I was to put it into an analogy, think of this attack kind of like editing the expiry date on your student ID to get discounts well after you graduated… something I am definitely NOT telling anyone to do!
There is an important caveat here, fortunately. This isn’t a case where someone can simply pick an expired Visa card out of a bin and immediately start spending with it. The researchers’ attack requires:
The researchers demonstrated this by one effectively emulating the payment card while the other communicated with the POS terminal, with the two devices communicating over Wi-Fi.
So this isn’t exactly a “find an old card in someone’s wallet and go shopping” vulnerability.. thankfully, otherwise I think we’d all be pretty concerned!
One of the more reassuring aspects of the research is that the same modification didn’t work across every major contactless payment network.
The researchers tested four EMV contactless kernels:
Visa — Kernel 3
The modified expiry date could pass the terminal’s processing checks without invalidating the relevant signature.
Mastercard — Kernel 2
The terminal checks the two expiry representations against each other. A mismatch is treated as a card data error.
American Express — Kernel 4
The expiry date is included within data protected by offline authentication, meaning that modifying it causes the cryptographic verification to fail.
Discover — Kernel 6
The transaction’s verification also detects the modification.
Ultimately, the research does not demonstrate that contactless payments as a whole can be bypassed by changing an expiry date.
Perhaps the most interesting finding in this isn’t actually the Zombie Card attack itself.
It’s how differently the banks responded. The researchers tested five major US banks initially, before carrying out more detailed testing against three of them. Their results showed three very different approaches.
If there were a single, universally enforced rule stating that an expired card must always be rejected by both the terminal and issuing bank, this particular attack would have considerably less room to operate.
Instead, payment networks, terminals and banks can each have their own approach to card lifecycle management.
And whenever different parts of a security system make different assumptions about the same piece of data, there’s a chance for something to slip through the gap.
The ultimate question in this attack, right? Well, researchers demonstrated successful transactions under some of the tested configurations.
One bank accepted modified transactions for amounts of $1, $100 and $500 on the researchers’ own terminal, while additional transactions of $2.79 and $3.19 were successfully completed at retail and grocery merchants on campus.
However, the researchers are careful to point out that this doesn’t mean every Visa card, bank or payment terminal is vulnerable.
Their testing was conducted in the United States and involved a limited number of banks and terminals.
The relay also needs to operate quickly enough to remain within the timing constraints of contactless transactions.
Overall, this attack is not something you’re going to start seeing globally at high frequencies; it’s more of a theoretic “wow, you can do that?” sort of thing.
Yes. Despite what you’ve just read above, it still reinforces a sensible piece of security hygiene.
When your bank replaces a card, don’t keep the old one intact indefinitely.
Cut through the chip and magnetic stripe before disposing of it, rather than simply throwing the card into the bin.
It’s also worth continuing to monitor your account after replacing a card, particularly if the underlying account remains open.
The researchers specifically recommend destroying the chip and magnetic stripe rather than disposing of expired cards intact.
For most businesses, this isn’t something that requires an immediate change to how you accept card payments.
The attack requires specialised equipment, proximity to the card and a particular combination of card, payment network, terminal and issuing-bank behaviour.
There is also no evidence that the technique has been used in the wild.
The researchers disclosed their findings to Visa and affected banks in May 2025 and followed up in December 2025. As of the publication of their research, no CVE had been assigned and there was no reported exploitation of the technique.
As I mentioned before, the lesson here is more so that there are always exploits you might think are impossible, or ones you simply had no idea existed.
We hope you’ve enjoyed this blog! We do plenty more on news in the Cyber scene like this, so stay tuned.
