[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fKVZ4jK5bkrOR_zTSkS9pS7gVhzrG8xDq6FsisNPCk3o":3},{"article":4,"iocs":48,"watch_terms":49,"solutions":50,"lesson":108},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"9f9ae05c-58e6-4130-a391-a5a43e3115e9","Your Expired Visa Card Could Be ‘Zombified’ to Make Contactless Payments","your-expired-visa-card-could-be-zombified-to-make-contactless-payments-e62140","Plus: Apple sends out an “unprecedented” number of spyware warnings, Ukraine hits a Russian ecommerce giant with cyber and drone attacks, and more.","Researchers have revealed a new technique where expired Visa cards can be 'zombified' to make contactless payments. By using a man-in-the-middle app on two phones, fraudsters can relay the card's data, exploiting authentication chain issues in Visa's contactless payment system. While some banks blocked these transactions, others did not, allowing expired cards to be used fraudulently.","Expired Visa cards can be 'zombified' for contactless payments due to authentication flaws.","https:\u002F\u002Fwww.wired.com\u002Fstory\u002Fsecurity-news-this-week-your-expired-visa-card-could-be-zombiefied-to-make-contactless-payments\u002F","https:\u002F\u002Fmedia.wired.com\u002Fphotos\u002F6a88b7f32773ab7e6c76bdb4\u002Fmaster\u002Fpass\u002FSecurityRoundUp_Week0821_v1.jpg","2026-08-22T10:30:00+00:00","2026-08-22T12:00:08.712066+00:00",7,[17,20,23],{"name":18,"type":19},"Visa","product",{"name":21,"type":22},"contactless payments","technology",{"name":18,"type":24},"vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":25,"icon":27,"name":28,"slug":29},null,"Vulnerabilities","vulnerabilities",[31,36,38,43],{"category":32},{"id":33,"icon":27,"name":34,"slug":35},"614132b8-5837-4952-b8b5-c6c9a32a1d85","Privacy","privacy",{"category":37},{"id":25,"icon":27,"name":28,"slug":29},{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[18],{"controls":51,"vendors":107},[52,81],{"slug":53,"name":54,"problem":55,"products":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[57,65,73],{"vendor_slug":58,"vendor_name":59,"vendor_logo":60,"product_slug":61,"product_name":62,"url":63,"description":64},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":82,"name":83,"problem":84,"products":85},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[86,94,99],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":95,"product_name":96,"url":97,"description":98},"ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"utimaco","Utimaco","\u002Fvendor-logos\u002Futimaco.png","utimaco-hsm","Utimaco General Purpose HSM","https:\u002F\u002Futimaco.com\u002Fdata-protection\u002Fgp-hsm","Hardware security modules for key generation, storage and cryptographic operations.",[],{"slug":109,"title":110,"body":111,"framework_refs":112,"framework_notes":122},"expired-visa-cards-exploited-for-contactless-payments-via-authentication-bypass","Expired Visa Cards Exploited for Contactless Payments via Authentication Bypass","Researchers discovered that expired Visa cards can be 'zombified' using a man-in-the-middle relay attack between two NFC-enabled phones, effectively bypassing the authentication chain in Visa's contactless payment protocol. The root cause lies in insufficient server-side validation of card expiry dates during contactless transactions, combined with weaknesses in how some banks enforce transaction authenticity checks. This matters because it undermines consumer trust in contactless payment systems and exposes financial institutions to fraud liability. The inconsistency in bank-level blocking also reveals a systemic gap — security controls that should be standardized across the ecosystem are instead left to individual issuers, creating exploitable weak links.",[113,114,115,116,117,118,119,120,121],"NIST SP 800-63B (Authentication Assurance)","NIST AC-17 (Remote Access Controls)","NIST SI-10 (Information Input Validation)","CIS Control 3: Data Protection","CIS Control 16: Application Software Security","PCI DSS Requirement 6.3 (Security Vulnerabilities Addressed)","PCI DSS Requirement 8.2 (User Identification and Authentication)","GDPR Article 32 (Security of Processing — appropriate technical measures)","ISO\u002FIEC 27001 A.14.1 (Security Requirements of Information Systems)",{}]