Listen to this Post
Introduction: When an Expired Card Refuses to Die
A payment card carries an expiration date for a reason. Consumers generally understand that once the printed month and year pass, the card is no longer supposed to work. Banks issue replacement cards, merchants rely on expiration checks, and payment systems are expected to treat the old credential as part of the card’s past.
But new security research has exposed an uncomfortable gap between what an expiration date means to a human and what it means to a payment system.
Researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza from the University of Massachusetts Amherst demonstrated a practical attack called “Zombie Card” that can make certain expired contactless Visa cards appear valid to a point-of-sale terminal. The work was presented at USENIX Security ’26 and examined real-world payment configurations involving Visa, Mastercard, Discover, American Express, multiple POS terminals, merchants, and five major U.S. banks.
The most important detail is that this is not a story about breaking the cryptography inside a payment card.
Instead, the researchers found a weakness in how different parts of the payment ecosystem divide responsibility for checking whether a card is still valid. In the affected Visa contactless flow, expiration can effectively become a terminal-side policy decision rather than a cryptographically protected property of the card.
That distinction is small on paper but enormous from a security perspective.
The Core Discovery: Expiration Is Not Always Cryptographically Enforced
The
The
That creates a dangerous dependency.
If a terminal receives an expiration date and independently decides whether that date is acceptable, the security of the decision depends on whether the expiration information itself is protected against manipulation.
According to the researchers,
In other words, the system can successfully prove that it is communicating with a legitimate card while failing to cryptographically prove that the expiration information being evaluated has not been altered.
What Makes the Zombie Card Attack Different
This attack should not be confused with traditional credit-card cloning.
An attacker does not need to extract a card’s secret cryptographic keys and create a perfect duplicate. The researchers instead demonstrated a man-in-the-middle relay scenario, where the legitimate physical card remains involved in the transaction.
The attacker effectively positions two NFC-capable devices between the card and the payment terminal.
One side communicates with the real expired card, while the other side communicates with the merchant’s POS terminal. The devices relay the payment protocol between them and manipulate specific information during that process.
The important trick is the alteration of the expiration field.
The terminal can be made to see a future expiration date even though the genuine card itself has already expired.
How the NFC Relay Works
The demonstration used two Android devices connected through a network.
One device operates close to the POS terminal and presents itself as the contactless card interface. The second device operates close to the legitimate expired card and communicates with its NFC interface.
The two devices then relay the payment protocol between the terminal and card.
At a high level, the architecture looks like this:
Merchant POS Terminal
|
| NFC
v
[NFC Relay Device]
|
| Network / Wi-Fi
v
[NFC Relay Device]
|
| NFC
v
Expired Visa Card
The attacker is therefore not trying to impersonate the entire card.
Instead, the attack attempts to become an invisible bridge between the genuine card and the genuine payment terminal.
That distinction is critical because the card can continue producing legitimate cryptographic responses.
The Expiration Date Becomes the Weak Link
The
The problem is not that EMV cryptography is generally broken.
The problem is that, in the affected Visa Kernel 3 transaction flow, the expiration value can be transmitted without being adequately bound to the cryptographically authenticated information used later in the transaction.
The researchers explain that the
This creates an unusual security paradox.
The terminal can effectively conclude:
This is a genuine card.
while also concluding:
“The expiration date I received says this card is still valid.”
Both statements can appear true from the
Why Cryptography Does Not Automatically Save the Transaction
It is tempting to assume that a chip card protected by sophisticated cryptography should make this attack impossible.
That assumption is understandable but incomplete.
Cryptography can guarantee the integrity of information only when that information is actually included in the authenticated cryptographic operation.
If an important security decision depends on a field that is outside the relevant authenticated data, the system can still contain an integrity gap.
This is one of the oldest lessons in security engineering: protecting 99 percent of a transaction does not automatically protect the remaining 1 percent.
And sometimes that remaining 1 percent contains the exact field that determines whether the transaction should be accepted.
Visa Kernel 3 Was the Important Outlier
The researchers did not limit their experiments to Visa.
They examined multiple contactless EMV implementations, including Mastercard Kernel 2, American Express Kernel 4, and Discover Kernel 6.
Their findings showed that the behavior was not universal.
Attempts to manipulate expiration-related information in the other tested implementations triggered integrity or signature failures that prevented the transaction from completing.
Visa Kernel 3 stood out because the researchers were able to manipulate the relevant expiration information while maintaining the cryptographic conditions necessary for the transaction to proceed.
This is an important distinction.
The research does not demonstrate that every contactless card can be revived after expiration.
It demonstrates that the security architecture of a particular payment flow can create a path through which an expired card remains usable under specific circumstances.
The Bank Still Has the Final Word
Another important discovery concerns the role of the issuing bank.
Even if a POS terminal accepts the manipulated expiration value, the issuer can still reject the transaction.
The researchers tested multiple banks and found that issuer behavior varied.
Some issuers rejected transactions involving expired cards. Others could authorize transactions when their authorization process validated the account and payment cryptogram without sufficiently enforcing the card’s expired or replacement status.
This makes the problem larger than a simple POS vulnerability.
It becomes a question of where the payment ecosystem decides that a card is no longer valid.
If the terminal makes the decision and the issuer trusts that decision, a manipulated terminal-side value can become surprisingly powerful.
The Real Security Problem Is Trust Fragmentation
Modern payment systems distribute responsibility across several components.
The card knows certain secrets.
The POS terminal interprets payment data.
The payment network transports transaction information.
The issuer decides whether the account should be authorized.
Each component performs part of the security process.
The Zombie Card research demonstrates what happens when those components do not share a single, cryptographically consistent understanding of card lifecycle state.
A card can be cryptographically genuine while being operationally obsolete.
A terminal can believe the card is valid.
An issuer can verify the transaction cryptogram.
And yet the transaction can still violate the intended policy that the old card should no longer be accepted.
This Is a Lifecycle Security Problem
The deeper lesson extends far beyond credit cards.
Security systems frequently distinguish between identity and authorization state.
A user account can be genuine but disabled.
A certificate can be authentic but revoked.
A device can be legitimate but no longer trusted.
A software token can have a valid signature but have been withdrawn.
A payment card can be genuine but expired.
In every one of these cases, proving identity is not enough.
The system must also prove that the identity is currently authorized to perform the requested action.
The Zombie Card attack exposes what happens when those two properties become separated.
Deep Analysis: Understanding the Attack Without Breaking Real Payment Systems
EMV Transaction Structure
At a simplified level, a contactless EMV transaction involves a conversation between the POS terminal and the payment card.
The terminal sends commands.
The card responds with application data.
The terminal evaluates that data.
The card participates in cryptographic authentication.
The issuer may ultimately validate the resulting transaction information.
The security of the entire process depends on the integrity of the information used at each stage.
Application Protocol Data Units
These exchanges use Application Protocol Data Units, commonly called APDUs.
A simplified diagnostic representation looks like:
POS Terminal
|
| APDU Request
v
Payment Card
|
| APDU Response
v
POS Terminal
The Zombie Card attack introduces a relay between these endpoints.
For defensive research, engineers can model the architecture without touching real payment credentials:
Terminal Emulator
|
v
Relay Simulator
|
v
Card Emulator
The objective should be to test whether security-sensitive fields remain cryptographically bound throughout the simulated transaction.
Expiration Data
The Application Expiration Date is represented by EMV data object:
5F24
A security assessment should ask a straightforward question:
Is 5F24 cryptographically authenticated
by the transaction data used for authorization?
If the answer is no, the architecture deserves further investigation.
Safe Defensive Inspection
Security teams can inspect transaction traces in a controlled test environment rather than manipulating production payment traffic.
For example:
grep -Ei '5F24|expiration|expiry' emv-test.log
A defensive parser could identify whether expiration information appears consistently across the transaction lifecycle:
grep -Ei '5F24|5f24|expiry|expiration' ./lab-logs/.log
These commands are useful for offline analysis of authorized test captures.
They do not perform an attack.
Integrity Validation
A test environment should then compare:
Expiration value received by terminal
vs.
Expiration value covered by authentication
vs.
Expiration value evaluated by issuer
The desired architecture is:
Card Lifecycle State
|
v
Cryptographically Authenticated
|
v
POS Terminal
|
v
Payment Network
|
v
Issuer
|
v
Independent Authorization Check
The most dangerous architecture is the opposite:
Card -> Terminal -> "Looks Valid" -> Issuer Trusts Terminal
The latter creates a security dependency on an intermediary’s interpretation.
Why a Relay Attack Is More Important Than It Sounds
NFC is often perceived as inherently secure because the communication range is short.
But short-range communication is not the same thing as secure communication.
A relay attack does not necessarily require an attacker to read a payment card from across a room.
Instead, the attacker attempts to extend the communication path by relaying information between two locations.
The security question therefore becomes:
Can the protocol distinguish between direct communication and relayed communication while maintaining transaction integrity?
For Zombie Card, the more important issue is not simply the existence of the relay.
It is the fact that the relay can alter a security-relevant field without causing the cryptographic transaction to fail.
The Attack Requires the Legitimate Physical Card
This limitation is important.
The research does not suggest that an attacker can simply manufacture an expired card number and walk into a store.
The legitimate physical card remains part of the demonstrated attack flow.
That means the threat model is considerably narrower than a conventional stolen-card or credential-theft scenario.
Nevertheless, the requirement does not make the research irrelevant.
A lost, discarded, replaced, or otherwise physically accessible card can potentially become valuable if the surrounding authorization infrastructure does not independently enforce its lifecycle status.
Expired Cards Should Not Be Treated as Harmless
Consumers often throw old payment cards into household garbage.
That is already poor security hygiene.
An expired card can contain information that should not simply be left intact.
More importantly, the research demonstrates why expiration should not be treated as an absolute security boundary unless the payment ecosystem actually enforces it.
The researchers recommend securely destroying expired or replaced cards, including cutting through the EMV chip and magnetic stripe, rather than disposing of them intact.
The Payment Industry Needs End-to-End Integrity
The strongest fix is not simply to tell POS terminals to check expiration more carefully.
The problem is architectural.
A security-sensitive field should be protected from the moment it originates until the moment it influences authorization.
That means expiration and replacement status should be bound to authenticated transaction information whenever appropriate.
The issuer should also independently enforce lifecycle state instead of blindly trusting a terminal’s local interpretation.
The research itself recommends countermeasures spanning payment kernels, issuers, and the broader payment infrastructure.
Why Issuer-Side Validation Matters
The issuer is ultimately in the best position to know whether a card remains active.
A bank knows when a card expired.
It knows when a replacement card was issued.
It knows whether the old credential was blocked.
It knows whether the account has been suspended.
That makes issuer-side enforcement an essential second line of defense.
If a transaction arrives from an apparently legitimate card but the issuer knows that the physical credential has been replaced, the issuer should have the authority and intelligence to reject it.
The Speed-versus-Security Trade-Off
The
Consumers expect contactless payments to complete almost instantly.
Merchants do not want authorization processes that introduce unnecessary delays.
Banks want high transaction throughput.
Payment networks want interoperability.
Every optimization, however, creates pressure to move security decisions closer to the edge.
That can produce a dangerous pattern:
The terminal makes the decision because it is faster.
But when the terminal makes the decision, the system must be certain that the information it used cannot be manipulated.
Speed cannot become an excuse for weakening the trust model.
What This Means for Payment Security Teams
Security teams should treat card lifecycle state as a first-class security property.
Expiration should not be considered merely a user-interface field.
Replacement status should not exist only inside a bank’s back-end database.
Terminal verification results should not be accepted without understanding their security guarantees.
And cryptographic authentication should cover every transaction attribute whose manipulation could change the authorization decision.
This principle applies well beyond payment cards.
Whenever a system says “this credential is valid until date X,” security engineers should ask whether that date is actually authenticated.
What Undercode Say: The Real Lesson Behind the Zombie Card
1. The Card Was Never Really Dead
The name Zombie Card is memorable because it captures the fundamental surprise: an expired card can remain cryptographically alive.
Expiration printed on plastic does not magically deactivate the chip.
The system has to enforce the lifecycle rule.
- Cryptography Is Only as Strong as Its Coverage
This research is another reminder that cryptography cannot protect information that is excluded from the authentication boundary.
A payment system can have extremely strong cryptographic primitives and still expose a security gap through one unauthenticated field.
3. Authentication and Authorization Are Different
The card can authenticate as genuine.
That does not mean it should still be authorized.
This distinction is one of the most important concepts in security architecture.
- The Terminal Should Not Be the Final Authority
A POS terminal is a valuable security component, but it should not become the sole authority over card lifecycle state.
The issuer has information the terminal does not.
- Replacement Status Matters as Much as Expiration
A card can be replaced before its printed expiration date.
That means an issuer must be able to distinguish between “old but not technically expired” and “no longer authorized.”
6. Relay Attacks Keep Returning
Relay attacks have appeared across NFC, contactless access systems, vehicle key systems, authentication tokens, and payment technologies.
The recurring lesson is simple: proximity is not a cryptographic guarantee.
- The Most Dangerous Bugs Live Between Systems
The vulnerability is not necessarily one broken component.
It emerges from the interaction between the card, kernel, POS terminal, network, and issuer.
Those boundaries are where security assumptions can collide.
8. Local Decisions Create Global Consequences
A terminal may make a tiny local decision about a date.
That decision can ultimately determine whether real money moves.
The more financially consequential the decision, the stronger its integrity requirements should be.
9. Faster Payments Need Stronger Architecture
Contactless payments are designed for speed.
But faster authorization makes it tempting to rely on precomputed or terminal-side decisions.
The solution is not to make payments slow.
The solution is to make security decisions cryptographically trustworthy.
10. Expiration Is a Security Boundary
Expiration should be treated like revocation.
If the system depends on it, it deserves cryptographic and policy-level protection.
- The Attack Is Narrow, But the Lesson Is Broad
Consumers should not interpret this research as “all expired Visa cards can be hacked.”
That would be an exaggeration.
The actual finding is more precise and more useful: under certain configurations, an attacker can manipulate expiration information during a relay attack against susceptible Visa contactless transaction flows.
12. Payment Ecosystems Need Defense in Depth
A resilient payment system should not collapse because one verification layer makes an incorrect decision.
Terminal checks, network controls, issuer authorization, fraud monitoring, and card lifecycle enforcement should reinforce one another.
13. Banks Should Validate Lifecycle State Independently
If the issuer already knows that a card has expired or been replaced, there is little justification for relying entirely on information supplied by the terminal.
Independent verification can turn a protocol weakness into a failed transaction instead of a successful one.
14. Security Engineers Should Test Assumptions
The research demonstrates the value of asking uncomfortable questions.
What happens after expiration?
Who checks it?
What exactly is cryptographically authenticated?
“What happens if the terminal is lied to?”
These questions frequently uncover vulnerabilities that ordinary compliance testing misses.
- The Industry Should Treat Payment Data as a Chain
Every security-sensitive field should have a clear chain of trust.
If the expiration date originates on the card, the terminal and issuer should be able to establish confidence that the value has not changed.
- EMV Security Is Not One Giant Shield
EMV contains sophisticated security mechanisms, but those mechanisms operate within specific protocol structures.
Security engineers must understand exactly what each mechanism authenticates.
- The Human Meaning of “Expired” Is Not Enough
Consumers think expiration means “this card no longer works.”
Technology needs a more precise definition.
Does the chip refuse transactions?
Does the terminal reject it?
Does the issuer reject it?
Or does the entire system merely assume that someone else already performed the check?
18. Every Assumption Is an Attack Surface
The most interesting aspect of Zombie Card is not the ability to modify a date.
It is the assumption that the date did not need stronger protection.
Attackers naturally search for precisely those assumptions.
19. Security Should Follow the Money
A field that can influence financial authorization deserves exceptional protection.
Payment systems cannot afford to treat lifecycle metadata as ordinary application data.
- This Is a Warning About Distributed Trust
Modern payment systems are distributed by design.
Distributed systems need explicit trust boundaries.
Without them, each component may assume another component is responsible for a security property.
- Nobody Wants to Be the “Other Component”
When an incident occurs, organizations often discover that every participant believed another system was responsible.
Security architecture should eliminate that ambiguity.
22. Authorization Should Be Explicit
A good payment architecture should answer one question definitively:
Is this specific credential authorized to perform this specific transaction right now?
Everything else should support that answer.
23. Fraud Detection Still Has a Role
Even strong cryptographic controls should be supplemented with behavioral fraud detection.
An unusual transaction involving an old credential, unusual location, unusual merchant, or unusual transaction pattern can provide additional signals.
24. Card Lifecycle Events Need Immediate Enforcement
When a replacement card is issued, the old credential should not remain unnecessarily trusted.
Lifecycle events should propagate reliably across authorization systems.
25. Security Testing Must Include Realistic Conditions
The
26. Commodity Hardware Changes the Threat Model
The researchers reported that the attack could operate using commodity NFC-capable devices rather than specialized hardware.
That does not make the attack universal, but it lowers the technical barrier for a capable attacker.
27. Physical Access Remains a Major Constraint
The attacker still needs the legitimate physical card in the demonstrated scenario.
That sharply limits mass exploitation compared with remote credential theft.
28. The Best Fix Is Architectural
Patching one terminal implementation may help.
Cryptographically binding lifecycle information and enforcing it at the issuer is much stronger.
29. Expired Cards Should Be Destroyed
Until systemic protections are deployed, consumers should not casually discard expired cards intact.
Physical destruction is simple and inexpensive.
30. Payment Security Is an Ecosystem Problem
Visa, banks, terminal vendors, payment processors, and merchants all participate in the transaction.
No single organization can completely solve an ecosystem-level trust problem alone.
- Researchers Are Valuable Because They Challenge “Obvious” Rules
Everyone knows an expired card should be rejected.
The interesting question is whether the technology actually enforces that rule.
32. Security Is About Enforcement, Not Intent
A specification can intend for expired cards to be rejected.
The implementation still has to enforce that intention.
33. Small Fields Can Have Huge Consequences
An expiration date may look like four digits.
Yet those four digits can influence whether money changes hands.
34. End-to-End Integrity Is the Goal
The strongest defense is to preserve the integrity of security-sensitive information from origin to authorization.
- The Research Should Lead to Better Testing
Payment providers should reproduce the attack in controlled laboratories and verify that modified expiration data causes transaction failure.
36. Issuers Should Assume Terminals Can Fail
A robust issuer should be designed under the assumption that terminal-side security decisions can occasionally be incorrect or manipulated.
37. The Principle Extends Beyond Payments
The same lesson applies to identity cards, access badges, digital certificates, API tokens, device credentials, and software licenses.
38. Security Boundaries Must Match Business Rules
If the business rule says “expired credentials cannot authorize transactions,” the cryptographic boundary should support that rule.
- Zombie Card Is a Warning, Not a Reason for Panic
There is no evidence from the research that every expired Visa card is suddenly exploitable everywhere.
The correct response is measured engineering, not fear.
40. The Final Lesson
A security system is only as strong as the weakest assumption connecting its components.
Zombie Card shows that an expiration date can become surprisingly powerful when a payment system trusts it without sufficiently protecting it.
That is precisely why this research matters.
✅ Fact: The Zombie Card attack was presented at USENIX Security ’26
The research was authored by Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza of the University of Massachusetts Amherst.
USENIX’s official research listing describes the attack as a practical method for making expired contactless cards appear unexpired under susceptible transaction configurations.
✅ Fact: The attack involves NFC relay and does not require breaking the card’s secret keys
The researchers describe a man-in-the-middle relay approach in which commodity NFC-capable devices sit between the legitimate card and POS terminal.
The attack therefore differs fundamentally from conventional card cloning or extraction of cryptographic secrets.
✅ Fact: Visa Kernel 3 was identified as susceptible in the researchers’ evaluation
The research found that Visa contactless transactions were susceptible to the demonstrated manipulation because expiration information was not effectively protected by the same integrity mechanisms as other transaction data.
Other evaluated payment kernels showed stronger resistance in the tested scenarios.
❌ Misleading Claim: Every expired Visa card can now be used indefinitely
That conclusion would go far beyond the evidence.
The attack depends on specific payment configurations, a relay setup, access to the legitimate physical card, and issuer behavior.
The research demonstrates a practical vulnerability under certain conditions—not universal resurrection of every expired payment card.
❌ Misleading Claim: Visa’s encryption was completely broken
The research does not show that attackers can simply break Visa’s cryptography or extract secret card keys.
The vulnerability instead involves insufficient integrity protection around expiration information in the affected transaction flow.
That difference is critical when assessing the real-world severity of the finding.
Prediction
(+1) Payment Networks Will Move Toward Stronger Lifecycle Authentication
The most likely long-term outcome is that payment networks and issuers will strengthen the relationship between card lifecycle information and cryptographically authenticated transaction data.
Expiration, replacement, suspension, and revocation status are too important to remain dependent on loosely protected terminal-side decisions.
(+1) Issuer-Side Validation Will Become More Important
Banks have the authoritative knowledge about whether a credential remains active.
Future payment architectures are likely to place greater emphasis on independent issuer-side lifecycle checks, especially when transaction data suggests that an old or replaced credential is being presented.
(+1) Security Testing Will Expand Beyond Cryptographic Breaks
The Zombie Card research is likely to encourage researchers and payment providers to examine not only whether cryptographic algorithms are secure, but also whether every business-critical field is actually covered by those algorithms.
(+1) Relay Attacks Will Receive Greater Attention
As NFC becomes increasingly embedded in payments, access control, transportation, identification, and digital credentials, relay attacks will remain an important research area.
The industry will increasingly need to distinguish genuine proximity from artificially extended communication.
(-1) Legacy Payment Infrastructure Could Remain Exposed
The biggest concern is not necessarily newly issued cards.
It is the long tail of terminals, kernels, processors, and issuer configurations that may take years to update.
Payment infrastructure is enormous, interconnected, and heavily dependent on backward compatibility.
That makes systemic fixes slower than software patches on ordinary computers.
(+1) Consumers Will Eventually Benefit From Better Card Lifecycle Controls
The ideal outcome is simple: once a card is expired or replaced, every relevant component of the payment ecosystem should agree that it is no longer authorized.
When that principle becomes technically enforced rather than merely assumed, the “zombie” disappears for good.
Final Perspective: The Card Is Only as Dead as the System Says It Is
The Zombie Card research exposes a fascinating contradiction in modern payment security.
A physical card can be expired.
Its cryptographic machinery can still function.
A POS terminal can be convinced that the expiration date is still in the future.
And an issuer may, depending on its authorization logic, accept the resulting transaction.
None of this requires breaking the fundamental cryptography of the card.
That is what makes the finding so valuable.
The lesson is not that contactless payments are fundamentally broken. The lesson is that security must follow the entire transaction, not just the cryptographic portions that look impressive on paper.
Expiration is a business rule.
Replacement is a business rule.
Authorization is a business rule.
When those rules determine whether money can move, they must be protected with the same seriousness as the cryptographic credentials used to authenticate the transaction.
The Zombie Card may sound like a clever name for a research demonstration, but the underlying message is much more serious: a credential is not truly dead when its printed date expires unless every security layer agrees that it is dead.
And in payment security, assumptions are often the first thing an attacker tries to resurrect.
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.twitter.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
