InfoSecBulletin Cybersecurity for mankind
Security experts have shown that expired credit cards can still be used. A study from the University of Massachusetts Amherst, shared at the 35th USENIX Security Symposium, presents a new NFC relay attack called “Zombie Card” that can make expired Visa contactless cards work again, letting them make real purchases at stores in many US banks.
The core discovery is deceptively simple: card expiration in EMV contactless payments is enforced as a transaction policy check performed by the terminal, not as a cryptographic fact baked into the card itself.
Jailbroken DeepSeek AI Agent Conducts Two-Week Cyberattack on European Telecom
Daily Cyber security update for 10.11. 2026
IBM fixes 208 API Connect vulnerabilities, 47 critical
89 New ransomware groups emerge in 2026, claiming over 2,200 victims
Daily Cyber security update for 08.11. 2026
Japan banking crisis
Outage causes disruption at 128 japan banks: preventing ATM transaction
Daily Cyber security update for 06.11. 2026
Cyber attack causes French bank Credit Mutuel Arkea €100 million missing
OpenAI AI Pipeline Discovers 948 Linux Kernel Privilege Escalation Flaws in 30 Hours
Bangladeshi Researcher Rasel Earns First Apple CVE Recognition for Model I/O Flaw
The private keys on a chip do not expire, and the certificates that prove a card’s identity during Offline Data Authentication usually stay valid long after the card’s printed date. This helps during reissuance times. So, the real expiry choice depends on one data field, the Application Expiration Date, which the terminal reads simply and checks on its own.
Zombie Card Back Online
Researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza built a tool that lets one phone pretend to be a card near a payment terminal, while another phone pretends to be the terminal near the real card, using Wi-Fi to talk to each other.
This setup allows them to catch and change APDU data during the transaction’s data retrieval phase in real time, using just regular smartphones.
Testing spanned EMV Kernel 2 (Mastercard), Kernel 4 (American Express), Kernel 6 (Discover), and Kernel 3 (Visa). Kernels 2, 4, and 6 detected tampering because expiry-related data is cryptographically bound to signed records or hashed transaction data, so any in-flight edit broke signature verification and killed the transaction. Kernel 3 was the outlier.
Its expiration field is not included in the signed application data, so changing a past date to a future one bypasses the terminal’s local check without invalidating any signature.
Kernel 3 sends an all-zero Terminal Verification Results field to the bank. This means the banks do not find out that the terminal’s local validation was changed.
This, along with card-side flags that can make a transaction go “online” even if expiry checks fail, allowed an expired card with a valid Primary Account Number to access the issuer’s authorization system without any issues.
The team checked the attack in a lab with SumUp machines and then tested it in real shops and grocery stores. They used their own old cards from five big US banks to keep others safe.
One bank let zombie transactions go through for amounts up to $500 because it only checked the account and cryptogram, not the specific card. Another bank always said no and asked users to use the new card. Interestingly, even a card that was not expired but had been replaced still allowed successful payments on the same account.
The researchers suggested ways to improve safety at all levels of the payment process: linking expiry information to signed records with security, checking that the expiry data matches what is sent to the issuers, treating expiry and replacement as clear signs of issuer approval, and keeping real validation results instead of deleting them.
For cardholders, the guidance is to destroy the chip and magnetic stripe of expired cards rather than discard them intact, and to keep monitoring a closed account.
Visa has not commented publicly on the findings. The paper records that its report to the network passed initial triage and is undergoing reproduction by Visa’s red team, and that “neither Visa nor the notified banks has provided any update on the status or nature of mitigations” as of the paper’s acceptance.
The relay and MitM implementation has not been released; the authors published sanitized transaction logs instead, and the paper’s first page carries USENIX’s artifact evaluation badge marked Available.
The development comes as Singapore-headquartered Group-IB documented a previously unseen Android NFC relay malware family it tracks as WindRelay, deployed alongside the SpyNote remote access trojan (RAT) in live-call social engineering against victims in Czechia, Slovakia, and Slovenia.
