Zombie Card Flaw Lets Expired Visa Cards Make Contactless Purchases

Security researchers from the University of Massachusetts Amherst have uncovered a critical vulnerability in Visa's contactless payment system that allows expired cards to be used for real-world purchases. The flaw, termed the 'Zombie Card' attack, enables the revival of defunct plastic to deceive point-of-sale (POS) terminals.

The vulnerability stems from how Visa's EMV contactless implementation—specifically Kernel 3—handles expiration dates. According to the researchers, the expiration date is treated as a terminal-side policy check rather than a cryptographic requirement. This allows an attacker to rewrite the expiration date transmitted over near-field communication (NFC) during the payment handshake. Because this data is not cryptographically bound to the authenticated transaction, the terminal accepts the modified date as valid without breaking the card's underlying security keys.

The EMV Standard Gap

EMV, the global standard for chip-based payments developed by Europay, Mastercard, and Visa, relies on a complex exchange of data between the card and the reader. In a standard contactless transaction, the card transmits its details via NFC. While the chip's private keys remain operational even after the printed expiration date has passed, the system is designed to rely on the POS terminal to reject the transaction based on the date provided.

This architecture creates a gap where the terminal assumes the data it receives is honest. By manipulating the selectively authenticated data in the contactless flow, the 'Zombie Card' attack bypasses the intended lifecycle of the payment instrument, effectively tricking the terminal into believing the card is still active.

Industry Implications

This discovery undermines a fundamental assumption in the payments industry: that an expired card is a useless piece of plastic. The ability to revive these cards opens a window for fraudsters to utilize stolen or recovered expired cards for unauthorized in-store transactions.

More broadly, the flaw highlights a systemic weakness in the EMV contactless flow. By leaving critical policy checks to the terminal rather than enforcing them cryptographically by the issuer, the system introduces a point of failure that can be exploited with relatively simple NFC manipulation tools.

What Remains

While the researchers have demonstrated that the attack works across POS terminals from multiple US banks, the full scale of the exposure remains to be seen. The industry must now determine if similar policy-based checks are being used for other critical card attributes. Observers will be watching for updates to the EMV Kernel 3 implementation to ensure that expiration dates are cryptographically bound to the transaction, removing the possibility of 'zombifying' expired credentials.