Zombie Card Attack Revives Expired Visa Cards for Unauthorized Payments

• •Expired Visa contactless cards can be exploited for unauthorized payments.
• •The 'Zombie Card' attack leverages weaknesses in the EMV protocol's expiration date checks.
• •Mastercard, American Express, and Discover cards are less vulnerable compared to Visa.

Researchers from the University of Massachusetts Amherst have demonstrated a vulnerability in Visa's EMV protocol that allows expired contactless credit cards to be used for unauthorized payments. This attack, termed the 'Zombie Card' attack, exploits the inconsistency in how expiration dates are checked during transactions. The researchers presented their findings at the USENIX Security 2026 conference, revealing that Visa's system does not cryptographically bind the expiration date, making it susceptible to man-in-the-middle attacks. The attack primarily affects Visa contactless cards, while configurations from Mastercard, American Express, and Discover were found to be more resilient. This loophole could potentially allow attackers to exploit expired cards that cardholders may still possess, raising concerns about payment security. The researchers provided a demonstration of the attack, highlighting the ease of exploiting the vulnerability with NFC proxy devices. As of now, no patches or fixes have been reported to address this issue.