Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale (POS) terminal reads over near-field communication (NFC), without breaking any of the card’s cryptography.
The attack, which the researchers named “Zombie Card,” requires physical possession of the expired card or sustained NFC proximity to it, plus a man-in-the-middle (MitM) relay positioned between the card and the terminal.
It also requires that the account remain open under the same primary account number (PAN), which is standard practice when an issuer sends a replacement card, and that the issuing bank not independently re-check the expiry during authorization.
The paper’s abstract describes an evaluation spanning five major US banks; the experiments with expired and replaced physical cards cover three of them, and of those three, one approved the revived transactions, one declined every attempt, and the third was running a different Europay, Mastercard, and Visa (EMV) kernel on which the modification failed outright.
The work was presented at the 35th USENIX Security Symposium in Baltimore from August 12 to 14, 2026. Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza disclosed the findings to Visa and the affected banks in May 2025 and made contact again in December 2025. No CVE has been assigned and no exploitation of the technique has been reported.
The Hacker News found no advisory, specification bulletin, or mitigation guidance published by Visa, EMVCo, Mastercard, Discover, American Express, or terminal vendor SumUp as of August 20, 2026.
Card expiry appears twice in a Visa contactless transaction, and the two representations are consumed by different parties. The terminal evaluates its processing restrictions against the Application Expiration Date, carried in Tag-Length-Value (TLV) tag 5F24. The issuer derives the expiry from Track 2 Equivalent Data, tag 57, which travels in the online authorization request.
According to the paper, Visa’s Kernel 3 does not require the two to be consistently bound, and the fast Dynamic Data Authentication (fDDA) signature the terminal verifies excludes 5F24 entirely. The relay rewrites the terminal-facing date to any future value and leaves Track 2 untouched, so the card’s signature and its issuer-verified cryptogram both still validate.
“Yet it is not cryptographically protected. So we can easily modify it to fool the POS,” Anwar, a doctoral candidate with the Khwarizmi Lab at UMass Amherst, said of the expiration date in a university release.
An expired card still passes offline data authentication because issuer and integrated circuit card certificate lifetimes are set independently of application expiry and routinely outlast the printed date.
The card’s private key encodes no notion of expiry at all. Kernel 3 also specifies that the Terminal Verification Results forwarded to the issuer are set to all zeros, so a bank cannot see whether the terminal ran or failed its local expiry check.
The attacker does not need to know the replacement card’s real expiration date. Any date later than the transaction date is sufficient.
The team ran the same modification against four EMV contactless kernels, the per-network implementations of the protocol, with the following outcomes –
- Visa (Kernel 3). The edit passed the terminal’s processing restrictions and did not invalidate the signature, because 5F24 is not among the signed data.
- Mastercard (Kernel 2). The terminal performs a consistency check between the two expiry representations during READ RECORD parsing and treats a mismatch as a card data error, declining rather than falling back online.
- American Express (Kernel 4). The expiration date is a mandatory record element bound into the static data covered by offline data authentication, producing a hash mismatch during signature validation.
- Discover (Kernel 6). Combined Dynamic Data Authentication binds the card-returned TLV objects into the verified transaction hash, and modified transactions were declined.
The relay itself was two NFC-capable Android phones running custom card-emulator and POS-emulator software over Wi-Fi, tested against SumUp Solo and SumUp Plus readers.
Each Application Protocol Data Unit (APDU) round trip added an estimated 20 milliseconds for relay and 50 milliseconds with modification, for a per-transaction average of about 415 milliseconds against the EMV limit of 500 milliseconds per command.
None of the physical cards or terminals in the testbed implemented EMV’s optional Relay Resistance Protocol (RRP), which bounds the permissible response time and would detect the added latency.
Against the issuer the researchers label Bank A, the revived card completed transactions of $1.00, $100.00, and $500.00 on the team’s own terminal registered under a Professional Services merchant category, plus $2.79 at a retail merchant and $3.19 at a grocery merchant on campus.
Bank B’s terminal accepted the modified expiry at all three lab amounts, but the issuer declined each one and prompted the cardholder to use the replacement card. Unmodified transactions with the expired card were correctly declined in every baseline run.
The banks are anonymized as A through E throughout, and the paper states that the retail and grocery purchases verify external validity only and do not constitute an ecosystem-wide measurement study across merchants, terminal vendors, or issuer configurations. All of the testing was conducted in the United States.
A separate finding sits outside the Visa result. One card in the test set had not expired but had been automatically replaced by its issuer for having under three months of validity remaining. Both the old card and its replacement continued to complete transactions against the same account, unmodified, on Kernel 6, where the expiry edit itself failed.
The paper sets out countermeasures spanning kernels, terminals, and issuers –
- Bind the expiry-critical data. The Application Expiration Date and the cardholder verification fields should be cryptographically bound to an issuer-verifiable signature, authenticated under offline data authentication, or covered by a kernel-defined transaction hash that fails under in-flight modification.
- Check the two expiry representations against each other. Where a kernel exposes more than one, the terminal should compare the value it consumes against the one carried in issuer-facing data and produce issuer-visible evidence where they diverge.
- Authorize against a PAN and expiry tuple. Issuers should treat the presented expiry as part of the credential identity and decline where it does not match the currently valid credential for that PAN.
- Preserve the terminal validation signals. Expiry-related terminal outcomes should reach the issuer, either by forwarding the actual Terminal Verification Results or through an equivalent issuer-visible indicator.
For cardholders, the guidance is to destroy the chip and magnetic stripe of expired cards rather than discard them intact, and to keep monitoring a closed account.
Visa has not commented publicly on the findings. The paper records that its report to the network passed initial triage and is undergoing reproduction by Visa’s red team, and that “neither Visa nor the notified banks has provided any update on the status or nature of mitigations” as of the paper’s acceptance.
The Hacker News has reached out to Visa for comment and to the researchers for further detail on the anonymized issuers, and will update this story with any response. The relay and MitM implementation has not been released; the authors published sanitized transaction logs instead, and the paper’s first page carries USENIX’s artifact evaluation badge marked Available.
The development comes as Singapore-headquartered Group-IB documented a previously unseen Android NFC relay malware family it tracks as WindRelay, deployed alongside the SpyNote remote access trojan (RAT) in live-call social engineering against victims in Czechia, Slovakia, and Slovenia.
In a report published August 12, 2026, the firm said it identified 23 samples uploaded to VirusTotal between November 2025 and July 2026 and four command-and-control (C2) IP addresses. That malware relays an active card in real time and does not touch the expiration date, but it uses the same two-device relay primitive the Zombie Card testbed depends on.
“This case shows that modern fraud rarely relies on one technique,” Group-IB said in the report.