Your expired credit card might not be as dead as you think.
Researchers at the University of Massachusetts Amherst just proved something unsettling at a security conference in Baltimore. They can revive an expired Visa card and make it work at real stores for real purchases. They call it the Zombie Card attack.
The mechanics are surprisingly straightforward. An attacker needs three things. First, physical access to the expired card or the ability to stay close to it with NFC equipment. Second, a man-in-the-middle relay setup using two smartphones positioned between the card and the payment terminal. Third, knowledge that the card’s account is still open, which is standard practice when banks send replacement cards.
The attack works by exploiting a critical weakness in how Visa handles expiration dates. The date appears twice in a contactless transaction. The terminal reads one version over NFC. The bank sees a different version during authorization. Visa’s protocol doesn’t cryptographically link these two representations together. So a relay can rewrite the date the terminal sees without breaking any of the card’s cryptography. The card’s signature still validates. The issuer’s cryptogram still works. But the terminal now thinks the card is fresh.
Lead researcher Raja Hasnain Anwar, a doctoral candidate at UMass Amherst, explained it clearly:
“It is not cryptographically protected. So we can easily modify it to fool the POS.”
The team tested this against five major US banks. One bank let modified expiration dates work and accepted transactions from multiple expired cards tied to the same account simultaneously. Another detected the modification but still accepted transactions from more than one card. A third ran Discover’s kernel and detected the modification but still allowed transactions from multiple cards. No bank rejected the attack cleanly.
The attack itself requires precision timing. The relay added about 70 milliseconds of latency per transaction. Visa’s EMV standard sets a 500-millisecond limit for authorization exchanges. The researchers stayed well within the window. And crucially, none of the terminals or cards they tested implemented EMV’s optional Relay Resistance Protocol, which would have caught the added latency immediately.
Real transactions completed against real bank systems. At one bank’s terminal registered as a Professional Services merchant, the team charged $1.00, $100.00, and $500.00 on the revived expired card. They also made actual retail and grocery store purchases on campus, including transactions for $2.79 and $3.19. Some went through without issue. Others were declined by the issuer after the fact, which prompted the cardholder to use the replacement card. But the point was made: the attack works in the wild.
The research was presented at the 35th USENIX Security Symposium from August 12 to 14, 2026. The team disclosed findings to Visa and the affected banks in May 2025, then followed up in December 2025. As of now, no CVE has been assigned. Visa has not commented publicly. The banks remain anonymous as “Bank A,” “Bank B,” and “Bank D” in the paper. No exploitation in the wild has been reported.
Visa’s Kernel 3 specification remains unchanged. Banks still exhibit wildly different policies about handling expired cards and their replacements. Some only check expiration dates during authorization, while some only treat an expired card and its replacement as separate instruments.
The researchers outlined four areas where the payment ecosystem needs to tighten security:
- Lock down the expiration date itself. Right now, the expiration date sits there unprotected. Card networks need to cryptographically sign it so nobody can change it in transit. The terminal should verify that signature before accepting the date. If someone tampers with it, the whole transaction fails. Period.
- Make terminals compare both dates. The terminal sees one expiration date. The bank sees another. They should match. If they don’t, the terminal should flag it immediately and send proof to the issuer. Right now, mismatches just get ignored. That needs to stop.
- Treat the expiration date as part of your identity. Banks need to understand that an expiration date change means you’re presenting different credentials. If the date doesn’t match what the bank has on file for your account number, decline the transaction. It’s that simple.
- Show the issuer what the terminal checked. Currently, the terminal validates the expiration date but doesn’t tell the bank whether that check passed or failed. That’s backwards. The issuer needs visibility into what the terminal actually verified so it can catch fraud attempts. Every validation result should travel back to the bank.
The paper outlines fixes spanning card networks, terminal vendors, and banks themselves. Expiration dates need to be cryptographically bound to signatures. Terminals should compare the two expiration representations and report mismatches to the issuer. Banks should authorize transactions as a combination of account number and expiration date, treating changes in either as a credential change. Terminal validation results about expiration checks should reach the issuer, not disappear into a black hole.
