A team from the University of Massachusetts Amherst has shown that a contactless credit card keeps working past its printed expiration date, even after the cardholder gets a replacement. They named it the Zombie Card attack and presented the findings at USENIX Security 2026.
The question behind the loophole
“This work is motivated by documented patterns of improper expired card handling. Although issuers instruct cardholders to destroy expired cards after replacement, cardholders routinely underestimate this risk precisely because expired cards are assumed to be inactive,” researchers wrote.
Credit card accounts don’t expire along with the physical card, so a return still gets refunded even after the purchasing card has expired. That’s what led Muhammad Taqi Raza, assistant professor in the Riccio College of Engineering at UMass Amherst, to ask: “If the card can get a refund, can the card make a payment?”
Working with Raja Hasnain Anwar and Gerard DeCunha, Raza found the answer is yes for at least some cards.
The researchers describe it as a gap between systems that each assume someone else already checked whether the card should still work. A contactless payment passes through the card, the checkout terminal, the merchant’s bank, a payment network, and the cardholder’s bank, and each one holds only a piece of that decision.
How the relay attack works
To test it, the researchers built a relay out of two ordinary smartphones, using the same near-field communication tech behind tap-to-pay.
Test equipment (Source: Research paper)
One phone activates the expired card and pulls its payment data, including the outdated expiration date. A second phone, linked over Wi-Fi, intercepts that data, rewrites the date, and passes it to the terminal.
Anwar notes that an attacker doesn’t need the correct new date, since almost any future date works. “It’s the only way for the POS to know whether a card is active or expired,” he said, adding that the date isn’t cryptographically protected, which makes it easy to modify and fool the reader.
The second phone taps the reader, and to an outside observer it looks like an ordinary digital-wallet payment. Per the team’s project page, the altered date falls outside what the card’s digital signature covers in the affected setup, so its cryptographic checks still pass.
Where the checks break down
“Our results show that Visa contactless transactions are susceptible to man-in-the-middle tampering due to a lack of effective integrity protection,” the team noted.
Testing the same approach against Mastercard, American Express, and Discover configurations, the team found each one rejected the altered date, since those systems tie the expiration data to a cryptographic check that a tampered date would break.
Bank behavior mattered as much as the card network. Against one major US bank, the reworked expired card completed purchases at $1, $100, and $500 in lab tests, and again on live purchases of $2.79 and $3.19 at retail and grocery merchants.
This bank’s checks only confirm the account exists and the card number is active, without checking whether that specific card instance is still the one on file. A second bank caught the same trick every time, declining the transaction and prompting the cashier to ask for the replacement card instead.
Part of what lets this slip through is what the terminal tells the bank. In Visa’s Kernel 3, the field that would normally flag an expired card to the issuer gets reset to all zeros before it’s sent along, so the bank has no way to see that the terminal’s own check would have failed.
Cards also carry a second expiration date, embedded in the digital certificate that secures communication between the card and the bank, and that certificate is often valid well past the date printed on the card, since issuers build in overlap for card renewals.
The researchers also found a related wrinkle with card replacement itself. One of their test cards hadn’t reached its printed expiration date but had been swapped out automatically because it had less than three months of validity left. In their tests, both the old card and its replacement kept working on the same account, which suggests a “replaced” card isn’t reliably treated as dead any more than an expired one is.
Disclosure and fixes
Researchers notified Visa and the affected banks in May and December 2025, with a reproduction guide, transaction records, and a demo video. Visa’s report passed initial triage and was being reproduced by its red team, but neither Visa nor the banks had confirmed a fix by publication. No CVE had been assigned.
The team withheld the relay code, since it could be repurposed for fraud, and published sanitized logs and protocol details instead. Their proposed fixes include binding the expiration date to a cryptographic check the way rival networks already do, keeping banks in the loop on what the terminal’s own checks found, and having issuers verify the specific card and expiration date on file rather than just the account number.
“Always discard your expired card, no matter what. Even if you permanently close your credit card, still monitor the transaction on the closed account,” concluded Raza.