New “Zombie Card” Flaw Lets Expired Visa Cards Make Contactless Payments

Cybersecuritynews •Guru Baran • August 20, 2026

Security researchers have demonstrated that an expired credit card is not as dead as most cardholders believe. A new study from the University of Massachusetts Amherst, presented at the 35th USENIX Security Symposium, reveals a practical NFC relay attack dubbed “Zombie Card” that revives expired Visa contactless cards, allowing them to complete real purchases at […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Zombie Card Attack Revives Expired Visa Cards for Unauthorized Payments Researchers from the University of Massachusetts Amherst have demonstrated a vulnerability in Visa's EMV protocol that allows expired contactless credit cards to be used for unauthorized payments. This attack, termed the 'Zombie Card' attack, exploits the inconsistency in how expiration dates are checked during transactions. The researchers presented their findings at the USENIX Security 2026 conference, revealing that Visa's system does not cryptographically bind the expiration date, making it susceptible to man-in-the-middle attacks. The attack primarily affects Visa contactless cards, while configurations from Mastercard, American Express, and Discover were found to be more resilient. This loophole could potentially allow attackers to exploit expired cards that cardholders may still possess, raising concerns about payment security. The researchers provided a demonstration of the attack, highlighting the ease of exploiting the vulnerability with NFC proxy devices. As of now, no patches or fixes have been reported to address this issue. 7 sources 65

Extracted Entities

New “Zombie Card” Flaw Lets Expired Visa Cards Make Contactless Payments

The full story

Extracted Entities

Attack Types (1)

Platforms (1)

Vulnerabilities (1)