A newly demonstrated NFC relay attack known as “Zombie Card” has shown that certain expired Visa contactless payment cards may still appear valid at point-of-sale terminals.
Researchers from the University of Massachusetts Amherst, Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza, presented the technique at USENIX Security ’26.
The research challenges the assumption that a physical payment card automatically becomes cryptographically unusable after its printed expiration date.
Zombie Card NFC Attack
Instead, the researchers found that, in the affected payment flow, expiration can function primarily as a terminal-side policy check rather than a cryptographically protected property of the card.
The vulnerability centers on Visa’s EMV contactless Kernel 3 implementation. According to the researchers, the chip’s cryptographic keys can remain operational after the printed expiration date, while the terminal separately reads and validates the Application Expiration Date.
The problem arises because this expiration information is not adequately bound to cryptographically authenticated transaction data.
As a result, an attacker can potentially alter an expired card’s expiration value during a transaction and make it appear as though the card remains valid.
Unlike conventional card cloning, the Zombie Card technique does not require attackers to extract secret chip keys or manufacture a counterfeit payment credential.
Instead, it relies on access to the legitimate physical card and manipulation of communication between the card and a payment terminal.
The proof-of-concept implementation uses two NFC-capable Android devices connected over Wi-Fi. One device communicates with the genuine expired card, while the second device interacts with the merchant’s contactless POS terminal.
During the transaction, the two devices relay EMV Application Protocol Data Units, or APDUs, between the legitimate card and the real payment terminal.
The attacker modifies the expiration-date field while the transaction data is being exchanged. Because the affected Visa Kernel 3 field is not protected with the same cryptographic integrity mechanisms applied to other transaction information, the terminal can process the modified expiration date without detecting the alteration.
The researchers also examined other major contactless EMV implementations to determine whether the same technique could be generalized across payment networks.
Their testing included Mastercard Kernel 2, American Express Kernel 4, and Discover Kernel 6. In those implementations, manipulating expiration-related information disrupted cryptographic signatures or integrity checks, causing the transaction to fail.
Visa Kernel 3 was identified as the notable outlier because its expiration value could be modified while preserving the cryptographic checks required for the transaction to continue.
The potential impact also depends on how individual card issuers perform authorization. Researchers observed that banks handled expired-card transactions differently.
Some issuers rejected transactions involving expired cards, while at least one issuer reportedly approved transactions because its authorization process validated the underlying account and payment cryptogram without sufficiently enforcing the card’s expiration or replacement status. This demonstrates that terminal-side validation alone may not provide adequate protection.
The researchers disclosed the issue to Visa and affected financial institutions in 2025. Proposed mitigations include cryptographically authenticating expiration information, ensuring that accurate terminal verification results reach issuers, and making expiration and card-replacement status mandatory issuer-side authorization conditions.
Until systemic fixes are deployed, consumers should securely destroy expired or replaced cards by cutting through both the EMV chip and magnetic stripe rather than discarding intact cards.
The Zombie Card research ultimately highlights a broader security lesson: payment credentials should not rely on a single local policy check when critical security properties can instead be cryptographically authenticated and independently enforced by the issuer.
No Comment! Be the first one.