Back Feeds2.Feedburner

Researchers find a loophole that lets expired credit cards make unauthorized payments

Feeds2.Feedburner •Sinisa Markovic • August 20, 2026

A team from the University of Massachusetts Amherst has shown that a contactless credit card keeps working past its printed expiration date, even after the cardholder gets a replacement. They named it the Zombie Card attack and presented the findings at USENIX Security 2026. The question behind the loophole “This work is motivated by documented patterns of improper expired card handling. Although issuers instruct cardholders to destroy expired cards after replacement, cardholders routinely underestimate this … More →

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Zombie Card Attack Revives Expired Visa Cards for Unauthorized Payments Researchers from the University of Massachusetts Amherst have demonstrated a vulnerability in Visa's EMV protocol that allows expired contactless credit cards to be used for unauthorized payments. This attack, termed the 'Zombie Card' attack, exploits the inconsistency in how expiration dates are checked during transactions. The researchers presented their findings at the USENIX Security 2026 conference, revealing that Visa's system does not cryptographically bind the expiration date, making it susceptible to man-in-the-middle attacks. The attack primarily affects Visa contactless cards, while configurations from Mastercard, American Express, and Discover were found to be more resilient. This loophole could potentially allow attackers to exploit expired cards that cardholders may still possess, raising concerns about payment security. The researchers provided a demonstration of the attack, highlighting the ease of exploiting the vulnerability with NFC proxy devices. As of now, no patches or fixes have been reported to address this issue. 7 sources 65

Researchers find a loophole that lets expired credit cards make unauthorized payments

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)