Researchers on the College of Massachusetts Amherst have demonstrated an assault that revives expired Visa contactless bank cards for actual in-store purchases by rewriting the expiration date a point-of-sale (POS) terminal reads over near-field communication (NFC), with out breaking any of the cardboard’s cryptography.
The assault, which the researchers named “Zombie Card,” requires bodily possession of the expired card or sustained NFC proximity to it, plus a man-in-the-middle (MitM) relay positioned between the cardboard and the terminal.
It additionally requires that the account stay open beneath the identical major account quantity (PAN), which is customary follow when an issuer sends a substitute card, and that the issuing financial institution not independently re-check the expiry throughout authorization.
The paper’s preliminary examine spans 5 main US banks and exams normal tampering with Europay, Mastercard, and Visa (EMV) transactions. Raja Hasnain Anwar, the lead writer, informed The Hacker Information that transactions succeeded at most of these banks when the crew modified the Client Machine Cardholder Verification Technique (CDCVM) flag, a consequence he known as alarming as a result of it rests on the identical weak point the expiry assault depends on, that transaction modifications go undetected.
Three of the 5 banks had been then examined with expired and changed bodily playing cards, and Anwar stated they confirmed three distinct insurance policies moderately than an easy move or fail. Financial institution A allowed the expiration date to be modified and accepted transactions from a couple of card at a time. Financial institution B detected the modification and accepted transactions from just one energetic card. Financial institution D, whose playing cards ran Uncover’s kernel, detected the modification however nonetheless accepted transactions from a couple of card.
The work was presented on the thirty fifth USENIX Safety Symposium in Baltimore from August 12 to 14, 2026. Anwar, Gerard DeCunha, and Muhammad Taqi Raza disclosed the findings to Visa and the affected banks in Could 2025 and made contact once more in December 2025. No CVE has been assigned and no exploitation of the method has been reported.
The Hacker Information discovered no advisory, specification bulletin, or mitigation steering printed by Visa, EMVCo, Mastercard, Uncover, American Categorical, or terminal vendor SumUp as of August 20, 2026.
Card expiry seems twice in a Visa contactless transaction, and the 2 representations are consumed by totally different events. The terminal evaluates its processing restrictions towards the Software Expiration Date, carried in Tag-Size-Worth (TLV) tag 5F24. The issuer derives the expiry from Observe 2 Equal Knowledge, tag 57, which travels within the on-line authorization request.
In accordance with the paper, Visa’s Kernel 3 doesn’t require the 2 to be constantly certain, and the quick Dynamic Knowledge Authentication (fDDA) signature the terminal verifies excludes 5F24 solely. The relay rewrites the terminal-facing date to any future worth and leaves Observe 2 untouched, so the cardboard’s signature and its issuer-verified cryptogram each nonetheless validate.
“But it’s not cryptographically protected. So we are able to simply modify it to idiot the POS,” Anwar, a doctoral candidate with the Khwarizmi Lab at UMass Amherst, said of the expiration date in a college launch.
An expired card nonetheless passes offline information authentication as a result of issuer and built-in circuit card certificates lifetimes are set independently of software expiry and routinely outlast the printed date.
The cardboard’s personal key encodes no notion of expiry in any respect. Kernel 3 additionally specifies that the Terminal Verification Outcomes forwarded to the issuer are set to all zeros, so a financial institution can not see whether or not the terminal ran or failed its native expiry test.
The attacker doesn’t must know the substitute card’s actual expiration date. Any date later than the transaction date is enough.
The crew ran the identical modification towards 4 EMV contactless kernels, the per-network implementations of the protocol, with the next outcomes –
- Visa (Kernel 3). The edit handed the terminal’s processing restrictions and didn’t invalidate the signature, as a result of 5F24 isn’t among the many signed information.
- Mastercard (Kernel 2). The terminal performs a consistency test between the 2 expiry representations throughout READ RECORD parsing and treats a mismatch as a card information error, declining moderately than falling again on-line.
- American Categorical (Kernel 4). The expiration date is a compulsory report aspect certain into the static information lined by offline information authentication, producing a hash mismatch throughout signature validation.
- Uncover (Kernel 6). Mixed Dynamic Knowledge Authentication binds the card-returned TLV objects into the verified transaction hash, and modified transactions had been declined.
The relay itself was two NFC-capable Android telephones operating customized card-emulator and POS-emulator software program over Wi-Fi, examined towards SumUp Solo and SumUp Plus readers.
Every Software Protocol Knowledge Unit (APDU) spherical journey added an estimated 20 milliseconds for relay and 50 milliseconds with modification, for a per-transaction common of about 415 milliseconds towards the EMV restrict of 500 milliseconds per command.
Not one of the bodily playing cards or terminals within the testbed applied EMV’s non-obligatory Relay Resistance Protocol (RRP), which bounds the permissible response time and would detect the added latency.
Towards the issuer the researchers label Financial institution A, the revived card accomplished transactions of $1.00, $100.00, and $500.00 on the crew’s personal terminal registered beneath a Skilled Companies service provider class, plus $2.79 at a retail service provider and $3.19 at a grocery service provider on campus.
Financial institution B’s terminal accepted the modified expiry in any respect three lab quantities, however the issuer declined each and prompted the cardholder to make use of the substitute card. Unmodified transactions with the expired card had been appropriately declined in each baseline run.
The banks are anonymized as A via E all through, and the paper states that the retail and grocery purchases confirm exterior validity solely and don’t represent an ecosystem-wide measurement examine throughout retailers, terminal distributors, or issuer configurations. The entire testing was carried out in america.
A separate discovering sits outdoors the Visa consequence. One card within the check set had not expired however had been mechanically changed by its issuer for having beneath three months of validity remaining. Anwar stated that for the interval earlier than the primary card’s personal expiration date, each it and its substitute had been in a position to make transactions towards the identical account, unmodified, on Kernel 6, the place the expiry edit itself failed.
Anwar stated the divergence between the three issuers issues greater than which one authorized or declined. “There isn’t any consensus within the business as to what’s the protected solution to deal with expiring playing cards,” he informed The Hacker Information, including that each financial institution and fee community units its personal priorities and is due to this fact uncovered to a special sort of assault.
He pointed to the identical crew’s 2024 USENIX Safety paper on digital wallets, In Wallet We Trust, which documented comparable inconsistencies in how issuers and pockets suppliers implement card lifecycle state.
The paper units out countermeasures spanning kernels, terminals, and issuers –
- Bind the expiry-critical information. The Software Expiration Date and the cardholder verification fields must be cryptographically certain to an issuer-verifiable signature, authenticated beneath offline information authentication, or lined by a kernel-defined transaction hash that fails beneath in-flight modification.
- Verify the 2 expiry representations towards one another. The place a kernel exposes a couple of, the terminal ought to examine the worth it consumes towards the one carried in issuer-facing information and produce issuer-visible proof the place they diverge.
- Authorize towards a PAN and expiry tuple. Issuers ought to deal with the introduced expiry as a part of the credential id and decline the place it doesn’t match the presently legitimate credential for that PAN.
- Protect the terminal validation alerts. Expiry-related terminal outcomes ought to attain the issuer, both by forwarding the precise Terminal Verification Outcomes or via an equal issuer-visible indicator.
For cardholders, the steering is to destroy the chip and magnetic stripe of expired playing cards moderately than discard them intact, and to maintain monitoring a closed account.
Visa has not commented publicly on the findings. The paper information that its report back to the community handed preliminary triage and is present process copy by Visa’s pink crew, and that “neither Visa nor the notified banks has supplied any replace on the standing or nature of mitigations” as of the paper’s acceptance.
The Hacker Information reached out to Visa for remark and had not obtained a response on the time of writing. The relay and MitM implementation has not been launched; the authors printed sanitized transaction logs as an alternative, and the paper’s first web page carries USENIX’s artifact analysis badge marked Out there.
The event comes as Singapore-headquartered Group-IB documented a beforehand unseen Android NFC relay malware household it tracks as WindRelay, deployed alongside the SpyNote distant entry trojan (RAT) in live-call social engineering towards victims in Czechia, Slovakia, and Slovenia.
In a report printed August 12, 2026, the agency stated it recognized 23 samples uploaded to VirusTotal between November 2025 and July 2026 and 4 command-and-control (C2) IP addresses. That malware relays an energetic card in actual time and doesn’t contact the expiration date, but it surely makes use of the identical two-device relay primitive the Zombie Card testbed relies on.
“This case reveals that fashionable fraud not often depends on one method,” Group-IB said in the report.
UPDATE (August 20, 2026): This story has been up to date with remark from lead writer Raja Hasnain Anwar on the scope of the five-bank preliminary examine and on how the three issuers examined with expired and changed playing cards differed in coverage moderately than solely in final result. Anwar additionally specified that the mechanically changed card and its substitute each transacted through the interval earlier than the primary card’s personal expiration date, a certain the paper doesn’t state. Visa had not responded to a request for remark on the time of writing.
