InfoSecBulletin Cybersecurity for mankind
Security experts have shown that expired credit cards can still be used. A study from the University of Massachusetts Amherst, shared at the 35th USENIX Security Symposium, presents a new NFC relay attack called “Zombie Card” that can make expired Visa contactless cards work again, letting them make real purchases at stores in many US banks.
The core discovery is deceptively simple: card expiration in EMV contactless payments is enforced as a transaction policy check performed by the terminal, not as a cryptographic fact baked into the card itself.
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
Nightmare Eclipse Drops New Microsoft Defender ‘ShieldCrash’ zero-day
cPanel Flaw Lets Hosting Accounts With Mail Privileges Execute Code as Root
FortiSandbox, FortiOS, FortiProxy ZTNA flaws unveil, while Fortigate firewall actively exploited
Microsoft Patch Tuesday September 2026 Fixed 973 Flaws Fixed, 2 Zero-Days
A single call: ShinyHunters Gained Access to 6 Million Customers’ Records
The first zero-click worm to spread through WeChat calls across iOS and Android
USA Bimbo Bakeries Confirms Data Stolen in Oracle EBS Zero-Day Attack
ALERT
Roundcube Webmail fixes 12 security flaws, including zero-click XSS and SSRF bypass
New HOOKEDGE Backdoor Deployed by Hackers in European Espionage
The private keys on a chip do not expire, and the certificates that prove a card’s identity during Offline Data Authentication usually stay valid long after the card’s printed date. This helps during reissuance times. So, the real expiry choice depends on one data field, the Application Expiration Date, which the terminal reads simply and checks on its own.
Zombie Card Back Online
Researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza built a tool that lets one phone pretend to be a card near a payment terminal, while another phone pretends to be the terminal near the real card, using Wi-Fi to talk to each other.
This setup allows them to catch and change APDU data during the transaction’s data retrieval phase in real time, using just regular smartphones.
Testing spanned EMV Kernel 2 (Mastercard), Kernel 4 (American Express), Kernel 6 (Discover), and Kernel 3 (Visa). Kernels 2, 4, and 6 detected tampering because expiry-related data is cryptographically bound to signed records or hashed transaction data, so any in-flight edit broke signature verification and killed the transaction. Kernel 3 was the outlier.
Its expiration field is not included in the signed application data, so changing a past date to a future one bypasses the terminal’s local check without invalidating any signature.
Kernel 3 sends an all-zero Terminal Verification Results field to the bank. This means the banks do not find out that the terminal’s local validation was changed.
This, along with card-side flags that can make a transaction go “online” even if expiry checks fail, allowed an expired card with a valid Primary Account Number to access the issuer’s authorization system without any issues.
The team checked the attack in a lab with SumUp machines and then tested it in real shops and grocery stores. They used their own old cards from five big US banks to keep others safe.
One bank let zombie transactions go through for amounts up to $500 because it only checked the account and cryptogram, not the specific card. Another bank always said no and asked users to use the new card. Interestingly, even a card that was not expired but had been replaced still allowed successful payments on the same account.
The researchers suggested ways to improve safety at all levels of the payment process: linking expiry information to signed records with security, checking that the expiry data matches what is sent to the issuers, treating expiry and replacement as clear signs of issuer approval, and keeping real validation results instead of deleting them.
For cardholders, the guidance is to destroy the chip and magnetic stripe of expired cards rather than discard them intact, and to keep monitoring a closed account.
Visa has not commented publicly on the findings. The paper records that its report to the network passed initial triage and is undergoing reproduction by Visa’s red team, and that “neither Visa nor the notified banks has provided any update on the status or nature of mitigations” as of the paper’s acceptance.
The relay and MitM implementation has not been released; the authors published sanitized transaction logs instead, and the paper’s first page carries USENIX’s artifact evaluation badge marked Available.
The development comes as Singapore-headquartered Group-IB documented a previously unseen Android NFC relay malware family it tracks as WindRelay, deployed alongside the SpyNote remote access trojan (RAT) in live-call social engineering against victims in Czechia, Slovakia, and Slovenia.
