UMass Researchers Revive Expired Visa Cards via NFC Protocol Flaw

Researchers from the University of Massachusetts Amherst have uncovered a critical vulnerability in the Visa contactless payment protocol that allows expired credit cards to be used for unauthorized purchases. The flaw enables attackers to trick point-of-sale (POS) terminals into accepting cards that should have been deactivated.

In a paper titled "Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments," presented at the USENIX Security 2026 conference, authors Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza detailed the exploit. The team used NFC proxy devices to execute a man-in-the-middle attack, which allowed them to alter the expiration date presented to the POS terminal. Crucially, this modification was achieved without invalidating the card's digital signature.

The Technical Gap

The vulnerability stems from a failure in Visa's EMV (Europay, Mastercard, and Visa) kernel. Specifically, the kernel does not cryptographically bind the expiration date used by the terminal to the one used during the online authorization process. This lack of integrity protection means the terminal can be fed a fake, current date while the backend authorization remains blind to the discrepancy.

According to the researchers, this is a byproduct of the industry's effort to maintain high transaction speeds and backward compatibility with older hardware. Because some data is sent in plaintext and only selectively authenticated to ensure performance, security gaps are created. Lead author and UMass Amherst doctoral candidate Raja Hasnain Anwar noted that the issue "comes down to the trade-off between performance and security," which often leaves room for such vulnerabilities.

Industry Implications

This discovery highlights a systemic weakness in how one of the world's largest payment networks handles the integrity of basic card data. The primary risk is that attackers could potentially scavenge discarded or stolen expired credit cards and revive them for fraudulent use. The success of such an attack depends on whether the issuing bank performs a rigorous, independent security check of the expiration date during the online authorization phase; if the bank relies on the terminal's reported data, the transaction will proceed.

What's Next

As the research makes its way through the security community, the focus shifts to whether Visa will update its EMV kernel to implement stricter cryptographic binding for expiration dates. While the researchers' results show that Visa contactless transactions are susceptible to this tampering, it remains to be seen how quickly the fix will be deployed across the global network of POS terminals and issuing banks.