Expired Visa cards exposed by contactless payment flaw

Security researchers have demonstrated a method for making some expired Visa contactless cards appear valid to payment terminals, exposing a weakness in how card expiry information is checked across the payment chain.

The technique, dubbed the “Zombie Card” attack, allows an attacker positioned between an expired card and a point-of-sale terminal to alter the expiry date transmitted through near-field communication. The manipulation can enable a payment without defeating the cryptographic protections normally used to authenticate the card.

Researchers Raja Hasnain Anwar, Gerard DeCunha and Muhammad Taqi Raza of the University of Massachusetts Amherst demonstrated the attack after testing contactless payment configurations involving cards from five major US banks. Their findings were presented at the USENIX Security Symposium 2026.

Tests covered Visa, Mastercard, American Express and Discover cards, as well as Apple Pay and Google Pay. The vulnerable configuration was found in Visa contactless transactions. The Mastercard, American Express and Discover configurations tested rejected attempts to modify the expiry information.

The weakness centres on Visa’s EMV Contactless Kernel 3 and the way payment systems handle two representations of a card’s expiry date. The point-of-sale terminal checks an Application Expiration Date supplied by the card, while information transmitted to the issuing bank can derive the expiry value from separate Track 2 Equivalent Data.

Under the configuration examined by the researchers, the expiry date used by the terminal is not sufficiently protected by the card’s digital signature. An attacker operating an NFC relay can therefore modify that value before it reaches the terminal while leaving cryptographic responses generated by the genuine card intact.

The researchers stressed that the technique does not crack Visa encryption, steal private cryptographic keys or forge the transaction cryptogram. Instead, it exploits a gap in the division of responsibility between the card, payment terminal and issuing bank.

A successful attack requires access to an expired physical card and equipment capable of relaying NFC communications. The experimental system used two commercially available Android smartphones, with one device communicating with the card and another interacting with the payment terminal.

Commands exchanged between the card and terminal were forwarded through the relay, allowing the expiry information to be changed during transmission. The additional delay introduced by the arrangement remained within normal payment-response limits during testing.

The team used commercial SumUp payment terminals and also validated the behaviour in controlled transactions at retail locations. A demonstration showed an expired Visa card completing a $100 contactless transaction. Tests found that the underlying expiry issue could also appear in transactions of $1 and $500 when terminal and issuer conditions permitted approval.

The attack is not guaranteed to work against every expired Visa card. Banks apply different authorisation policies, and some institutions tested by the researchers rejected transactions or required use of the replacement card. Others allowed payments when the terminal accepted the modified expiry information.

That distinction highlights a broader payment-security problem. Card expiration is often treated as a policy decision rather than a cryptographically enforced property of the physical credential. An expired card may therefore continue producing valid authentication data even though it is no longer supposed to be used.

Visa’s Kernel 3 specifications require terminals to perform processing restrictions involving the card’s Application Expiration Date under applicable transaction conditions. However, the researchers found that the terminal-visible expiry information was not reliably bound to authenticated data throughout the transaction.

Issuing banks can independently stop the attack by checking whether the specific physical card presented for payment remains active rather than relying primarily on the status of the associated account. A replaced card may share account relationships with its successor even though the older credential should no longer authorise purchases.

The researchers disclosed the findings to Visa in May 2025 and followed up in December 2025. As of this week, no public confirmation of a comprehensive mitigation covering the demonstrated configuration had emerged.

The work also points to relay-resistance technology as a possible defensive layer. The EMV Relay Resistance Protocol can detect abnormal communication delays associated with relay attacks, but the protection is optional and was not active on the cards and terminals used in the tests.