InfoSecBulletin Cybersecurity for mankind
Security experts have shown that expired credit cards can still be used. A study from the University of Massachusetts Amherst, shared at the 35th USENIX Security Symposium, presents a new NFC relay attack called “Zombie Card” that can make expired Visa contactless cards work again, letting them make real purchases at stores in many US banks.
The core discovery is deceptively simple: card expiration in EMV contactless payments is enforced as a transaction policy check performed by the terminal, not as a cryptographic fact baked into the card itself.
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
“InfoSecCon-2026: Bangladesh’s Cybersecurity Leaders Unite to Shape a Safer Digital Future”
Microsoft Patches CVSS 10.0 Azure AI Foundry Vulnerability Allowing Privilege Escalation
AWS is unable to restore access to Bahrain, one UAE cloud data zone after war damage
Cisco Warns of Critical ISE 0-Day Flaw and Hackers Allegedly Selling Fortinet FortiGate 1-Day Flaw
Anthropic prepares “Claude Money” to analyze bank account and financial data
GhostCode Phishing Kit Evades Microsoft 365 MFA to Hijack Accounts in 78 Seconds
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
The private keys on a chip do not expire, and the certificates that prove a card’s identity during Offline Data Authentication usually stay valid long after the card’s printed date. This helps during reissuance times. So, the real expiry choice depends on one data field, the Application Expiration Date, which the terminal reads simply and checks on its own.
Zombie Card Back Online
Researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza built a tool that lets one phone pretend to be a card near a payment terminal, while another phone pretends to be the terminal near the real card, using Wi-Fi to talk to each other.
This setup allows them to catch and change APDU data during the transaction’s data retrieval phase in real time, using just regular smartphones.
Testing spanned EMV Kernel 2 (Mastercard), Kernel 4 (American Express), Kernel 6 (Discover), and Kernel 3 (Visa). Kernels 2, 4, and 6 detected tampering because expiry-related data is cryptographically bound to signed records or hashed transaction data, so any in-flight edit broke signature verification and killed the transaction. Kernel 3 was the outlier.
Its expiration field is not included in the signed application data, so changing a past date to a future one bypasses the terminal’s local check without invalidating any signature.
Kernel 3 sends an all-zero Terminal Verification Results field to the bank. This means the banks do not find out that the terminal’s local validation was changed.
This, along with card-side flags that can make a transaction go “online” even if expiry checks fail, allowed an expired card with a valid Primary Account Number to access the issuer’s authorization system without any issues.
The team checked the attack in a lab with SumUp machines and then tested it in real shops and grocery stores. They used their own old cards from five big US banks to keep others safe.
One bank let zombie transactions go through for amounts up to $500 because it only checked the account and cryptogram, not the specific card. Another bank always said no and asked users to use the new card. Interestingly, even a card that was not expired but had been replaced still allowed successful payments on the same account.
The researchers suggested ways to improve safety at all levels of the payment process: linking expiry information to signed records with security, checking that the expiry data matches what is sent to the issuers, treating expiry and replacement as clear signs of issuer approval, and keeping real validation results instead of deleting them.
For cardholders, the guidance is to destroy the chip and magnetic stripe of expired cards rather than discard them intact, and to keep monitoring a closed account.
Visa has not commented publicly on the findings. The paper records that its report to the network passed initial triage and is undergoing reproduction by Visa’s red team, and that “neither Visa nor the notified banks has provided any update on the status or nature of mitigations” as of the paper’s acceptance.
The relay and MitM implementation has not been released; the authors published sanitized transaction logs instead, and the paper’s first page carries USENIX’s artifact evaluation badge marked Available.
The development comes as Singapore-headquartered Group-IB documented a previously unseen Android NFC relay malware family it tracks as WindRelay, deployed alongside the SpyNote remote access trojan (RAT) in live-call social engineering against victims in Czechia, Slovakia, and Slovenia.
