'Zombie Card' Attack: Expired Contactless Cards Still Make Payments, UMass Amherst Shows
Researchers at the University of Massachusetts Amherst showed that a contactless credit card can keep making payments past its printed expiration date, even after a replacement arrives. They call it the Zombie Card attack, presented at USENIX Security 2026.
A contactless credit card can keep making payments after the expiration date printed on its face, and in the researchers' tests it kept working even after the bank issued a replacement. That is the core of the Zombie Card attack, work from the University of Massachusetts Amherst presented at USENIX Security 2026 and reported this week by The Register and Help Net Security.
The finding matters because the expiration date is one of the few consumer-facing signals people trust to mean a card is dead. The UMass Amherst team (Raja Hasnain Anwar, Gerard DeCunha, and assistant professor Muhammad Taqi Raza) showed that assumption does not always hold at the checkout terminal. This piece separates what the researchers actually demonstrated from what is still unconfirmed, and turns it into concrete steps for two audiences: the cardholder in the checkout line, and the issuer or network deciding whether to approve a tap.
What the Researchers Found
The starting point is a quirk most people never notice: a credit card account does not expire when the plastic does. Refunds still post to an expired card because the account behind it stays open. That led Raza to a simple question. "If the card can get a refund, can the card make a payment?" he asked. For at least some cards, the answer was yes.
Using a relay built from two ordinary smartphones and the same near-field communication behind tap-to-pay, the team presented a future expiration date to the terminal instead of the printed one. In the affected configuration, that date is not covered by the card's cryptographic checks, so the transaction still looked like an ordinary digital-wallet payment. The researchers state the root cause plainly: "Our results show that Visa contactless transactions are susceptible to man-in-the-middle tampering due to a lack of effective integrity protection." (The CyberSignal does not publish the operational steps; the team itself withheld its relay code and released only sanitized logs and protocol details.)
This was not only a lab curiosity. Against one major US bank, the reworked card cleared test purchases of $1, $100, and $500, and then live purchases of $2.79 and $3.19 at retail and grocery checkouts, according to Help Net Security's account of the paper.
● Where the Expiry Check Falls Through The same contactless tap can be approved or declined, depending on what the issuer actually verifies. |
The Tap Arrives A payment passes through the card, terminal, merchant bank, network, and issuing bank. Each layer holds only one piece of the expiry decision. |
↓ |
Account-Only Check → Clears The issuer confirms the account exists and the number is active, but not whether this exact card and its printed expiry are still the one on file. The charge goes through. |
Card-Instance Check → Declines The issuer verifies the specific card and expiry on record, or the network binds the date to a cryptographic value. The tampered tap is refused. |
Source: UMass Amherst, "Zombie Cards Back Online," USENIX Security 2026. Defender view, not an attack guide. |
How the same expired-card tap clears at one issuer and is declined at another, based on the UMass Amherst research.
Which Cards and Banks Are Affected?
By the researchers' account, the weakness is specific, not universal. The team reported that Mastercard, American Express, and Discover configurations rejected the altered date, because those systems tie the expiration value to a cryptographic check that breaks when the date is changed. Bank behavior mattered just as much. One issuing bank cleared the tampered tap every time, while a second declined it and prompted the cashier to ask for the replacement card.
Several points are worth flagging as not yet independently confirmed. The scope rests on a single research team's tests against a limited set of cards, terminals, and banks, not an industry-wide audit. Visa and the affected banks were notified in 2025, and the report reached Visa's red team for reproduction, but neither Visa nor the banks had confirmed a fix by publication, and no CVE has been assigned. Treat the specific networks, issuers, and terminal models involved as the researchers' reported results rather than settled fact.
Why This Is Hard to Fix
The honest answer is that no single party owns the expiry check. A contactless payment passes through the card, the checkout terminal, the merchant's bank, a payment network, and the cardholder's bank, and each one holds only a piece of the decision about whether the card should still work. The researchers describe exactly this: a gap between systems that each assume someone else already checked. When verification only confirms that the account exists and the card number is active, a card that has been "replaced" is not reliably treated as any more dead than one that has expired.
What Consumers Should Do
The single most useful step is the oldest advice on the card mailer, and the research gives it new weight: physically destroy expired cards. Shred or cut through both the chip and the card number rather than leaving old plastic in a drawer. Raza's own guidance is blunt: "Always discard your expired card, no matter what. Even if you permanently close your credit card, still monitor the transaction on the closed account."
Two habits back that up. Watch statements on closed and replaced accounts, not just active ones, because a charge on a card you thought was dead is the clearest signal something is wrong. And keep contactless cards where a stranger cannot get a sustained tap, since the attack needs close physical proximity to the card. For readers tracking the wider consumer picture, it fits the pattern in the FBI's latest numbers on record cybercrime losses, and in individual cases like the wallet-app theft that cost one musician $424,000: the weak point is often an assumption, not a break-in.
What Issuers and Networks Should Verify
For the defenders who own the acceptance layer, the fix is to stop trusting the printed date as an integrity signal and start verifying the specific card. The researchers' proposed direction is threefold: bind the expiration date to a cryptographic check the way rival networks already do, keep the issuing bank informed of what the terminal's own check found rather than discarding it, and verify the exact card and expiration on file rather than just the account number. Payment-security teams reviewing their own stacks can also learn from how enterprise payment software gets exploited when validation is assumed rather than enforced, as in the Oracle E-Business Suite payments flaw. The common thread is the same: a check that exists on paper but is not enforced end to end.
My read: this is a design gap, not a fraud wave, and it should be read that way. The attack needs physical access to your card and a live relay, a high bar next to simply stealing a number online, so the near-term risk to any one cardholder is low. What makes it worth attention is the principle it exposes. An entire payment chain quietly agreed that "someone else checks the expiry," and for one network and one bank configuration, no one did. That is the kind of shared blind spot that survives for years precisely because it never belongs to a single team. The cheap, immediate defense sits with the consumer (destroy the card), but the durable fix sits with the networks and issuers who can make the printed date mean something again.
