InfoSecBulletin Cybersecurity for mankind
Security experts have shown that expired credit cards can still be used. A study from the University of Massachusetts Amherst, shared at the 35th USENIX Security Symposium, presents a new NFC relay attack called “Zombie Card” that can make expired Visa contactless cards work again, letting them make real purchases at stores in many US banks.
The core discovery is deceptively simple: card expiration in EMV contactless payments is enforced as a transaction policy check performed by the terminal, not as a cryptographic fact baked into the card itself.
Splunk, Zyxel Patch Multiple Flaws Enabling RCE and Root Command Execution
“Zombie Card” attack revels expired Visa card may be used for contactless payments
Critical Zimbra RCE Flaw Actively Exploited in the Wild
Operation CameraSwarm
A single hacker compromise 1400+ Dahua camera worldwide
Cl0p Ransomware Listed 40+ Victims of PTC Windchill Campaign
Oracle Issues 943 Security Patches, Including Critical WebLogic Flaw
500+ critical infrastructure hit by Medusa ransomware
Critical WordPress Plugin Flaw Exposes 600,000 Sites to Attacks
Apple Patches 28 Security Flaws in macOS, iOS, and iPadOS
DoNot (APT-C-35) Targeting Bangladesh Military Personnel
The private keys on a chip do not expire, and the certificates that prove a card’s identity during Offline Data Authentication usually stay valid long after the card’s printed date. This helps during reissuance times. So, the real expiry choice depends on one data field, the Application Expiration Date, which the terminal reads simply and checks on its own.
Zombie Card Back Online
Researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza built a tool that lets one phone pretend to be a card near a payment terminal, while another phone pretends to be the terminal near the real card, using Wi-Fi to talk to each other.
This setup allows them to catch and change APDU data during the transaction’s data retrieval phase in real time, using just regular smartphones.
Testing spanned EMV Kernel 2 (Mastercard), Kernel 4 (American Express), Kernel 6 (Discover), and Kernel 3 (Visa). Kernels 2, 4, and 6 detected tampering because expiry-related data is cryptographically bound to signed records or hashed transaction data, so any in-flight edit broke signature verification and killed the transaction. Kernel 3 was the outlier.
Its expiration field is not included in the signed application data, so changing a past date to a future one bypasses the terminal’s local check without invalidating any signature.
Kernel 3 sends an all-zero Terminal Verification Results field to the bank. This means the banks do not find out that the terminal’s local validation was changed.
This, along with card-side flags that can make a transaction go “online” even if expiry checks fail, allowed an expired card with a valid Primary Account Number to access the issuer’s authorization system without any issues.
The team checked the attack in a lab with SumUp machines and then tested it in real shops and grocery stores. They used their own old cards from five big US banks to keep others safe.
One bank let zombie transactions go through for amounts up to $500 because it only checked the account and cryptogram, not the specific card. Another bank always said no and asked users to use the new card. Interestingly, even a card that was not expired but had been replaced still allowed successful payments on the same account.
The researchers suggested ways to improve safety at all levels of the payment process: linking expiry information to signed records with security, checking that the expiry data matches what is sent to the issuers, treating expiry and replacement as clear signs of issuer approval, and keeping real validation results instead of deleting them.
For cardholders, the guidance is to destroy the chip and magnetic stripe of expired cards rather than discard them intact, and to keep monitoring a closed account.
Visa has not commented publicly on the findings. The paper records that its report to the network passed initial triage and is undergoing reproduction by Visa’s red team, and that “neither Visa nor the notified banks has provided any update on the status or nature of mitigations” as of the paper’s acceptance.
The relay and MitM implementation has not been released; the authors published sanitized transaction logs instead, and the paper’s first page carries USENIX’s artifact evaluation badge marked Available.
The development comes as Singapore-headquartered Group-IB documented a previously unseen Android NFC relay malware family it tracks as WindRelay, deployed alongside the SpyNote remote access trojan (RAT) in live-call social engineering against victims in Czechia, Slovakia, and Slovenia.
