Researchers find a loophole that lets expired credit cards make unauthorized payments
UMass Amherst researchers showed at USENIX Security 2026 that NFC relay attacks can rewrite unprotected expiration dates, letting expired Visa contactless cards keep making payments.
UMass Amherst researchers presented the Zombie Card attack at USENIX Security 2026, using two smartphones to relay and modify NFC payment data from expired Visa cards. The expiration date lies outside the card's digital signature coverage in Visa Kernel 3, and one major US bank accepted $1-$500 test purchases plus live $2.79 and $3.19 purchases with rewritten dates. Mastercard, American Express, and Discover rejected tampered dates; researchers notified Visa in May 2025 and no CVE or confirmed fix existed at publication.
- Relay rewrites the expiration date since almost any future date fools the terminal
- One bank's checks only confirm the account exists, not the specific card instance
- Visa Kernel 3 resets the expired-card field, hiding terminal check results from issuers
- Proposed fixes include cryptographically binding the date like rival card networks
- Organizations
- University of Massachusetts Amherst
From the original article
4 min read at helpnetsecurity.com
A team from the University of Massachusetts Amherst has shown that a contactless credit card keeps working past its printed expiration date, even after the cardholder gets a replacement. They named it the Zombie Card attack and presented the findings at USENIX Security 2026. “This work is motivated by documented patterns of improper expired card handling.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.