InfoSecBulletin Cybersecurity for mankind
Security experts have shown that expired credit cards can still be used. A study from the University of Massachusetts Amherst, shared at the 35th USENIX Security Symposium, presents a new NFC relay attack called “Zombie Card” that can make expired Visa contactless cards work again, letting them make real purchases at stores in many US banks.
The core discovery is deceptively simple: card expiration in EMV contactless payments is enforced as a transaction policy check performed by the terminal, not as a cryptographic fact baked into the card itself.
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
Hacker stole Meta GitHub repos; Stole Source Code
Urgent patch! Zoom,NVIDIA and IBM Patch 41 Security flaws
Microsoft patches record braking 1411 flaws; 2 zero days
The private keys on a chip do not expire, and the certificates that prove a card’s identity during Offline Data Authentication usually stay valid long after the card’s printed date. This helps during reissuance times. So, the real expiry choice depends on one data field, the Application Expiration Date, which the terminal reads simply and checks on its own.
Zombie Card Back Online
Researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza built a tool that lets one phone pretend to be a card near a payment terminal, while another phone pretends to be the terminal near the real card, using Wi-Fi to talk to each other.
This setup allows them to catch and change APDU data during the transaction’s data retrieval phase in real time, using just regular smartphones.
Testing spanned EMV Kernel 2 (Mastercard), Kernel 4 (American Express), Kernel 6 (Discover), and Kernel 3 (Visa). Kernels 2, 4, and 6 detected tampering because expiry-related data is cryptographically bound to signed records or hashed transaction data, so any in-flight edit broke signature verification and killed the transaction. Kernel 3 was the outlier.
Its expiration field is not included in the signed application data, so changing a past date to a future one bypasses the terminal’s local check without invalidating any signature.
Kernel 3 sends an all-zero Terminal Verification Results field to the bank. This means the banks do not find out that the terminal’s local validation was changed.
This, along with card-side flags that can make a transaction go “online” even if expiry checks fail, allowed an expired card with a valid Primary Account Number to access the issuer’s authorization system without any issues.
The team checked the attack in a lab with SumUp machines and then tested it in real shops and grocery stores. They used their own old cards from five big US banks to keep others safe.
One bank let zombie transactions go through for amounts up to $500 because it only checked the account and cryptogram, not the specific card. Another bank always said no and asked users to use the new card. Interestingly, even a card that was not expired but had been replaced still allowed successful payments on the same account.
The researchers suggested ways to improve safety at all levels of the payment process: linking expiry information to signed records with security, checking that the expiry data matches what is sent to the issuers, treating expiry and replacement as clear signs of issuer approval, and keeping real validation results instead of deleting them.
For cardholders, the guidance is to destroy the chip and magnetic stripe of expired cards rather than discard them intact, and to keep monitoring a closed account.
Visa has not commented publicly on the findings. The paper records that its report to the network passed initial triage and is undergoing reproduction by Visa’s red team, and that “neither Visa nor the notified banks has provided any update on the status or nature of mitigations” as of the paper’s acceptance.
The relay and MitM implementation has not been released; the authors published sanitized transaction logs instead, and the paper’s first page carries USENIX’s artifact evaluation badge marked Available.
The development comes as Singapore-headquartered Group-IB documented a previously unseen Android NFC relay malware family it tracks as WindRelay, deployed alongside the SpyNote remote access trojan (RAT) in live-call social engineering against victims in Czechia, Slovakia, and Slovenia.
