Expired Credit Cards Vulnerable to 'Zombie Card' Attacks

• •Expired Visa cards can be exploited for contactless payments through a 'Zombie Card' attack.
• •The attack requires physical access to the expired card and uses two NFC smartphones.
• •Consumers should destroy expired cards to prevent unauthorized use.

Researchers at the University of Massachusetts Amherst discovered a security vulnerability that allows some expired credit cards, specifically certain Visa cards, to be used for contactless payments. This method, termed a 'Zombie Card' attack, involves modifying the expiration date read by payment terminals, enabling transactions with expired cards. The attack requires physical access to the expired card and utilizes two NFC-capable smartphones to relay and alter information. The researchers tested cards from five major U.S. banks and found that while some Visa cards were vulnerable, Mastercard, American Express, and Discover cards did not exhibit the same vulnerability. The findings were disclosed to Visa and affected banks in May 2025, but as of the study's acceptance, no confirmed mitigations had been reported. Consumers are advised to destroy expired cards properly to mitigate this risk.