A recent research report from the University of Massachusetts Amherst shows a frightening possibility for contactless payments: under specific conditions, an expired Visa NFC card can still be accepted at real in-store terminals. The team calls the technique the Zombie Card attack, because it effectively “revives” cards that should no longer work.
Importantly, the work is not presented as a universally usable method. It depends on how the payment flow validates expiry data and on a particular kind of relay setup between the card and the POS terminal.
What researchers mean by the Zombie Card attack
The core idea is straightforward. Researchers demonstrated an attack that alters the expiration date a POS terminal reads via NFC. They do this by inserting a relay between the card and the terminal that rewrites the date value the terminal consumes—while keeping the card’s cryptographic protections intact.
According to the paper, the researchers did not break the card’s cryptography. Instead, they targeted a field that affects terminal processing rules. In the Visa case described, the expiration date is not cryptographically bound in the same way it would need to be to prevent this kind of manipulation.
Why expiration dates can appear twice in a contactless transaction
A key part of the story is that card expiry information is represented in different places in a transaction, and those representations are handled by different parties.
In the Visa contactless flow described by the researchers, the terminal checks its own processing restrictions against the Application Expiration Date, carried in a TLV field identified as tag 5F24. Meanwhile, the issuer derives an expiry value from Track 2 Equivalent Data, tag 57, which is included in the online authorization request.
The research argues that Visa Kernel 3 does not require these two expiry representations to be consistently bound. In addition, the fast Dynamic Data Authentication (fDDA) signature the terminal verifies excludes tag 5F24, which makes it possible to change what the terminal sees without invalidating the signature it checks.
What the attack setup requires
The Zombie Card attack is not just a theoretical claim. The researchers describe a physical and technical requirement set:
- Physical possession of the expired card, or sustained NFC proximity to it.
- A man-in-the-middle (MitM) relay positioned between the card and the terminal.
- The card must still be tied to an account that remains open under the same primary account number (PAN), which is common when an issuer sends a replacement card.
- At least in the Visa scenario, the issuing bank should not independently re-check the expiry during authorization in a way that blocks the modified value.
The paper emphasizes that the attackers do not need to know the replacement card’s real expiration date. Any date later than the transaction date is sufficient for the terminal-side check described.
Results by payment kernel: not all networks behaved the same
The researchers tested the modification against multiple EMV contactless kernels—EMV’s per-network implementations of the protocol—and reported different outcomes.
Visa (Kernel 3): accepted by the terminal-side rules
For Visa Kernel 3, the edited expiration date passed the terminal’s processing restrictions. The researchers state that the signature validation did not catch the change because 5F24 was not among the signed data in that context.
Mastercard (Kernel 2): declined due to consistency checks
In the Mastercard Kernel 2 tests, the terminal performed a consistency check between the expiry values it obtained during parsing. A mismatch led the terminal to treat the data as a card error and declined rather than fall back online.
American Express (Kernel 4): blocked by offline authentication binding
For American Express Kernel 4, the expiration date was described as a mandatory record element bound into the static data covered by offline data authentication. As a result, the modified data triggered a validation failure.
Discover (Kernel 6): declined due to transaction-hash binding
Discover Kernel 6 uses Combined Dynamic Data Authentication that binds returned TLV objects into the verified transaction hash. The researchers report that modified transactions were declined under those conditions.
How the relay was built in the study
To implement the relay, the researchers used two NFC-capable Android phones with custom card-emulator and POS-emulator software. They ran the relay over Wi-Fi and tested against card readers including SumUp Solo and SumUp Plus.
The team also discusses timing. Each NFC/APDU round trip added some delay—about 20 ms for the relay itself and about 50 ms when modification was applied. They report an average transaction time around 415 ms against a 500 ms limit per command in EMV’s processing constraints.
Crucially, the physical cards and terminals used in the testbed did not implement EMV’s optional Relay Resistance Protocol (RRP), which is designed to detect excessive response time.
Issuer behavior: some banks accepted, others declined
The paper evaluates interactions with multiple major U.S. banks. The researchers anonymize issuers as Bank A through Bank E.
One Bank scenario reported in the study accepted transactions where the terminal-side expiry check was satisfied, including test purchases at amounts such as $1.00, $100.00, and $500.00, along with additional smaller grocery and retail values on campus.
In another bank scenario, the terminal accepted the modified expiry each time, but the issuer declined the transactions and prompted the cardholder to use the replacement card. The researchers also state that baseline tests with an unmodified expired card were correctly declined.
In a separate case, a card that had not expired still got replaced by its issuer due to low remaining validity. In that situation, the modification failed on Kernel 6, because the underlying expiry edit itself did not work as expected in the tested kernel.
No CVE and no public mitigation guidance at the time
At the time of reporting, the research notes that no CVE (Common Vulnerabilities and Exposures) had been assigned and that no exploitation of the technique had been reported publicly.
The reporting also indicates that, as of late August 2026, there was no publicly available advisory or specific mitigation guidance published by major payment stakeholders mentioned in the report (including Visa, EMVCo, Mastercard, Discover, American Express, and a terminal vendor named in the source article).
The researchers presented the work at the 35th USENIX Security Symposium in Baltimore in August 2026, and they had disclosed findings to Visa and the affected banks in mid-2025, with follow-up contact later in 2025. The paper states that Visa’s triage process accepted the report for further review, and that reproduction by internal teams was underway.
Countermeasures the authors recommend
The paper outlines mitigation ideas across kernels, terminals, and issuers. While implementation details vary, the themes are consistent: bind the right data cryptographically, compare expiry representations, and make issuer-side signals reflect what the terminal actually validated.
- Cryptographically bind expiry-critical data so modified terminal-facing values cannot pass verification.
- Compare multiple expiry representations when a kernel exposes them, and ensure inconsistencies become visible to the issuer.
- Authorize using a PAN/expiry tuple so the issuer can reject presentations that do not match the currently valid credential for that PAN.
- Preserve terminal validation signals by forwarding terminal verification outcomes (or equivalent evidence) to the issuer so the issuer cannot be blind to local checks.
For cardholders, the guidance reported focuses on destroying the chip and magnetic stripe of expired cards rather than keeping them intact, and continuing to monitor accounts that have been closed or should no longer be used.
Why this matters for real-world contactless fraud
The Zombie Card attack illustrates a broader point in payment security: fraud does not always need to defeat cryptography to cause harm. If protocol design leaves a gap—such as a field the terminal validates but that is not cryptographically bound—an attacker may be able to manipulate behavior without breaking the underlying security primitives.
At the same time, the study’s kernel-by-kernel results show that defenses are not uniform across payment networks. That unevenness likely drives both urgency and the need for coordinated mitigations between issuers and terminal ecosystems.
Bottom line
The Zombie Card attack demonstrates that, under certain conditions involving an NFC relay and specific EMV validation behavior, expired Visa contactless cards could be used for in-store purchases without breaking card cryptography. The research includes timing constraints, relay setup details, and varied results across different payment kernels—along with recommended fixes aimed at cryptographic binding, consistency checks, and issuer-visible validation signals.
As of the time described in the reporting, no CVE was issued and public mitigation guidance was not yet found from major stakeholders, making this a topic worth monitoring closely for updates and follow-on testing.
Source: https://thehackernews.com/2026/08/zombie-card-attack-can-revive-expired.html
