Overview
- Researchers at the University of Massachusetts Amherst presented the Zombie Card at USENIX Security and showed that an expired contactless card can be made to complete purchases by changing the expiration date the terminal reads.
- The exploit uses two ordinary smartphones where one reads the expired card over NFC and a second rewrites the terminal-facing expiration field and relays the altered data to the POS reader.
- Tests and live purchases showed the flaw works against Visa’s Kernel 3 when certain issuers only check the account number and not the specific card instance, while Mastercard, American Express, and Discover configurations rejected the tampered data.
- The team disclosed the research to Visa and affected banks in May and December 2025, Visa’s internal teams were reproducing the issue as of the paper’s publication, and no public fix or CVE has been confirmed.
- Recommended fixes include cryptographic binding of the terminal expiration field, forwarding terminal validation results to issuers, and issuer-side checks of the presented expiry and card instance, and consumers are urged to destroy expired cards and monitor accounts.