Your Shredded Visa Card May Still Work at the Checkout
Brief
UMass Amherst researchers showed expired Visa contactless cards can make real purchases by exploiting an unsigned expiry field in Visa’s EMV kernel.
Researchers at the University of Massachusetts Amherst demonstrated at USENIX Security 2026 in Baltimore that expired Visa contactless credit cards can complete real purchases, including transactions at live retail and grocery merchants, by exploiting a gap in how the payment protocol handles expiration dates.
The paper is titled “ Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments ,” and the name is accurate.
Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza built the attack around a structural weakness in EMV, the contactless payment protocol used by Visa, Mastercard, American Express, and Discover.