“Zombie Card” Attack Lets Expired Visa Cards Make Contactless Payments
Brief
A newly demonstrated practical NFC relay attack can make certain expired Visa contactless cards appear valid at point-of-sale terminals.
Dubbed “Zombie Card,” the technique was presented by researchers at the University of Massachusetts Amherst, Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza, at USENIX Security ’26.
The finding challenges the belief that a card becomes cryptographically unusable once its printed expiry date passes. In the affected payment flow, expiry is handled as a terminal-side policy check rather than as a cryptographic property of the card.
“Zombie Card” Attack Lets Expired Visa Cards
The chip’s private keys can remain operational beyond the printed expiration date, leaving the payment terminal to read and locally validate the Application Expiration Date.