Your Expired Visa Card Could Be ‘Zombified’ to Make Contactless Payments
Expired Visa cards can be 'zombified' for contactless payments due to authentication flaws.
Researchers have revealed a new technique where expired Visa cards can be 'zombified' to make contactless payments. By using a man-in-the-middle app on two phones, fraudsters can relay the card's data, exploiting authentication chain issues in Visa's contactless payment system. While some banks blocked these transactions, others did not, allowing expired cards to be used fraudulently.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Visa?
Get an email when a new story names Visa, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonResearchers discovered that expired Visa cards can be 'zombified' using a man-in-the-middle relay attack between two NFC-enabled phones, effectively bypassing the authentication chain in Visa's contactless payment protocol. The root cause lies in insufficient server-side validation of card expiry dates during contactless transactions, combined with weaknesses in how some banks enforce transaction authenticity checks. This matters because it undermines consumer trust in contactless payment systems and exposes financial institutions to fraud liability. The inconsistency in bank-level blocking also reveals a systemic gap — security controls that should be standardized across the ecosystem are instead left to individual issuers, creating exploitable weak links.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.