A team of researchers at the **University of Massachusetts Amherst** has demonstrated a proof-of-concept attack that allows expired **Visa** contactless credit cards to be used for in-store purchases. The attack, named '**Zombie Card**,' leverages a vulnerability in the **Visa Kernel 3** implementation of the **EMV** (Europay, Mastercard, and Visa) protocol, allowing an attacker to rewrite the expiration date presented to the POS terminal. ### How the 'Zombie Card' Attack Works The '**Zombie Card**' attack requires physical possession of the expired card or sustained NFC proximity, along with a man-in-the-middle (MitM) relay positioned between the card and the terminal. The core of the attack lies in the differing ways **Visa** contactless transactions handle expiration dates. An expired card's expiry date appears twice in a **Visa** contactless transaction: the **Application Expiration Date** (TLV tag 5F24) consumed by the terminal, and the expiry derived from **Track 2 Equivalent Data** (tag 57) used in the online authorization request by the issuer. According to the researchers, **Visa's Kernel 3** does not mandate consistency between these two representations. Crucially, the fast Dynamic Data Authentication (fDDA) signature verified by the terminal excludes tag 5F24 entirely. The MitM relay intercepts the transaction, rewrites the terminal-facing expiration date to a future value, and leaves the **Track 2** data untouched. This ensures that the card's signature and the issuer-verified cryptogram both remain valid. > "Yet it is not cryptographically protected. So we can easily modify it to fool the POS," stated **Raja Hasnain Anwar**, a doctoral candidate with the **Khwarizmi Lab** at **UMass Amherst**, highlighting the vulnerability.  ### Experimental Validation and Impact The researchers evaluated the attack across five major US banks. Experiments with expired and replaced physical cards showed that one bank approved the revived transactions, another declined all attempts, and a third used a different **EMV** kernel where the modification failed. The team successfully ran the modification against four **EMV** contactless kernels with varying outcomes: * **Visa (Kernel 3):** The edit bypassed terminal processing restrictions and did not invalidate the signature, as 5F24 is not part of the signed data. * **Mastercard (Kernel 2):** The terminal performs a consistency check, treating a mismatch as a card data error. * **American Express (Kernel 4):** The expiration date is a mandatory record element bound into static data, leading to a hash mismatch. * **Discover (Kernel 6):** Combined Dynamic Data Authentication binds the card-returned TLV objects into the verified transaction hash, causing declines. The relay itself was implemented using two NFC-capable **Android** phones running custom card-emulator and POS-emulator software over Wi-Fi, tested against **SumUp Solo** and **SumUp Plus** readers. The added latency for relay and modification averaged 415 milliseconds per transaction, well within the **EMV** limit of 500 milliseconds. Crucially, none of the tested physical cards or terminals implemented **EMV's optional Relay Resistance Protocol (RRP)**, which would detect such added latency.  ### Countermeasures and Recommendations The researchers presented their work at the 35th **USENIX Security Symposium** and disclosed their findings to **Visa** and affected banks in May 2025 and again in December 2025. As of August 20, 2026, no **CVE** has been assigned, and no exploitation of the technique has been reported. Neither **Visa** nor other payment networks have published advisories or mitigation guidance. The paper outlines several countermeasures: * **Bind expiry-critical data:** Cryptographically bind the **Application Expiration Date** and cardholder verification fields to an issuer-verifiable signature. * **Cross-check expiry representations:** Terminals should compare different expiry values and report discrepancies to the issuer. * **Authorize against PAN and expiry tuple:** Issuers should treat the presented expiry as part of the credential identity and decline mismatches. * **Preserve terminal validation signals:** Expiry-related terminal outcomes should be communicated to the issuer. For cardholders, the guidance is to destroy the chip and magnetic stripe of expired cards and continue monitoring closed accounts. **Visa** has not commented publicly, but the report indicates their red team is attempting to reproduce the findings.