New Zombie Card Attack Lets Expired Visa Cards Make Contactless Payments

Gbhackers •Divya • August 20, 2026

Security researchers have demonstrated a “Zombie Card” attack that can reactivate certain expired Visa contactless cards, allowing them to be used for NFC payments. This attack exploits a vulnerability in Visa’s EMV Kernel 3 regarding the handling of card expiry data. An attacker, positioned between the card and the payment terminal, can modify the expiry […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Zombie Card Attack Revives Expired Visa Cards for Unauthorized Payments Researchers from the University of Massachusetts Amherst have demonstrated a vulnerability in Visa's EMV protocol that allows expired contactless credit cards to be used for unauthorized payments. This attack, termed the 'Zombie Card' attack, exploits the inconsistency in how expiration dates are checked during transactions. The researchers presented their findings at the USENIX Security 2026 conference, revealing that Visa's system does not cryptographically bind the expiration date, making it susceptible to man-in-the-middle attacks. The attack primarily affects Visa contactless cards, while configurations from Mastercard, American Express, and Discover were found to be more resilient. This loophole could potentially allow attackers to exploit expired cards that cardholders may still possess, raising concerns about payment security. The researchers provided a demonstration of the attack, highlighting the ease of exploiting the vulnerability with NFC proxy devices. As of now, no patches or fixes have been reported to address this issue. 9 sources 65

New Zombie Card Attack Lets Expired Visa Cards Make Contactless Payments

The full story

Extracted Entities

Attack Types (1)

Platforms (1)