Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments

Summary: Researchers at the University of Massachusetts Amherst demonstrated a 'Zombie Card' attack that revives expired Visa contactless cards for in-store purchases by rewriting the expiration date a POS terminal reads over NFC, without breaking the card's cryptography. The attack needs physical possession of the expired card or sustained NFC proximity, a man-in-the-middle relay between card and terminal, an account still open under the same PAN, and an issuing bank that does not re-check expiry during authorization; the team disclosed findings to Visa and affected banks in May 2025 and again in December 2025, presented at the 35th USENIX Security Symposium in Baltimore from August 12 to 14, 2026, and no CVE or reported exploitation exists.
Why it matters: Against the issuer labeled Bank A, the revived card completed transactions of $1.00, $100.00, and $500.00 on the team's own terminal plus $2.79 and $3.19 at campus merchants, and the three banks tested with expired and replaced cards showed three distinct policies rather than a pass or fail. As of August 20, 2026, The Hacker News found no advisory, specification bulletin, or mitigation guidance from Visa, EMVCo, Mastercard, Discover, American Express, or terminal vendor SumUp.

Read the original at The Hacker News ↗