Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments
Aug 20, 2026
Vulnerability / Financial Security
Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale (POS) terminal reads over near-field communication (NFC), without breaking any of the card's cryptography. The attack, which the researchers named " Zombie Card ," requires physical possession of the expired card or sustained NFC proximity to it, plus a man-in-the-middle (MitM) relay positioned between the card and the terminal. It also requires that the account remain open under the same primary account number (PAN), which is standard practice when an issuer sends a replacement card, and that the issuing bank not independently re-check the expiry during authorization. The paper's preliminary study spans five major US banks and tests general tampering with Europay, Mastercard, and Visa (EMV) transactions. Raja Hasnain Anwar, the lead author, told The Hac...
