Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments
Researchers demonstrate 'Zombie Card' attack reviving expired Visa contactless cards for payments.
Researchers at UMass Amherst have developed a 'Zombie Card' attack that can revive expired Visa contactless cards for in-store purchases. The attack rewrites the expiration date read by the POS terminal via NFC without breaking cryptography, requiring physical possession or sustained proximity and a man-in-the-middle relay. While not all banks were susceptible, one major US bank approved transactions using this method.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Visa?
Get an email when a new story names Visa, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonResearchers demonstrated that Visa's contactless payment protocol can be exploited by rewriting the expiration date transmitted via NFC to a POS terminal, effectively 'reviving' expired cards without breaking cryptographic protections. The root cause lies in insufficient server-side validation by certain issuing banks, which failed to cross-check the expiration date presented at the terminal against their authoritative records. This matters because it exposes a systemic gap in how payment networks trust terminal-reported card data over independently verified bank records. The fact that at least one major US bank approved fraudulent transactions confirms this is not merely theoretical — real financial losses are possible at scale with minimal technical sophistication.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.