Security researchers have demonstrated a “Zombie Card” attack that can reactivate certain expired Visa contactless cards, allowing them to be used for NFC payments.
This attack exploits a vulnerability in Visa’s EMV Kernel 3 regarding the handling of card expiry data. An attacker, positioned between the card and the payment terminal, can modify the expiry information sent to the terminal without compromising the transaction’s cryptographic checks.
Researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza from the University of Massachusetts Amherst presented their findings in a paper at the 35th USENIX Security Symposium.
Their work highlights that expiry enforcement can fail when the terminal and issuer use different, inconsistently validated representations of a card’s expiration date.
How the Attack Works
The exploit requires an active NFC man-in-the-middle relay between an expired physical card and a point-of-sale terminal.
In the researchers’ proof of concept, two NFC-capable Android phones served as a card emulator near the terminal and a POS emulator near the expired card, relaying contactless payment traffic between them.
During the transaction, the attacker intercepts the Application Expiration Date data object, known as EMV tag 5F24, and alters it from a past date to a future date. This modification is sufficient for the terminal’s local expiry check to pass.
Importantly, the researchers leave the Track 2 Equivalent Data unchanged. This data, which also includes an expiry value, is typically sent to the issuer during online authorization.
Under Visa Kernel 3, the terminal-facing 5F24 value is not consistently cryptographically bound to the signed data verified during the transaction, allowing for in-flight modifications without compromising the fast Dynamic Data Authentication or the issuer-verifiable application cryptogram.
As a result, the terminal erroneously believes the card is valid despite it being expired.
EMV contactless payments distribute security decisions across the card, terminal, acquirer, payment network, and issuing bank. The study found that Visa Kernel 3 creates a particularly permissive environment because the terminal relies on a single expiry value. In contrast, the issuer may use a different one.
For an issuer to approve the payment, the expired card must still have valid cryptographic material, and the account associated with its Primary Account Number (PAN) must remain active.
The researchers observed that issuer behavior varied: one bank approved altered transactions for different amounts and merchant types. At the same time, another consistently declined them and advised customers to use their replacement cards.
The attack does not defeat EMV cryptography or forge a payment card. Instead, it exploits a failure in lifecycle enforcement: an old card can still generate a valid transaction cryptogram. At the same time, an issuer might authorize based on an active account or PAN, rather than verifying the expiration date of the specific physical card.
The researchers tested real-world transactions involving various EMV kernels, terminals, merchants, and five major U.S. banks.
Their findings suggest that this issue is not a universal failure across all EMV systems: similar modifications did not work against Mastercard Kernel 2, American Express Kernel 4, or Discover Kernel 6 because those implementations either checked for consistency between expiry representations or cryptographically protected the relevant data.
The threat model also has substantial constraints. An attacker needs access to an expired, replaced, lost, or stolen card, as well as the ability to establish an NFC relay position between the card and the payment terminal.
Thus, the technique is operationally more demanding than simple card skimming. However, it demonstrates that expired cards should not be automatically deemed harmless.
The paper suggests that payment networks and terminal vendors should cryptographically bind expiry-critical data to authenticated transaction fields and enforce consistency between terminal-facing and issuer-facing expiry values.
Issuers should treat the PAN and expiry date as a combined credential identity and decline authorization when the presented card lifecycle state does not match the active instrument.
Banks should consistently revoke old card credentials after issuing replacements, including for low-value and online authorizations. Payment systems could further reduce exposure by conveying meaningful terminal validation results to issuers instead of masking them with all-zero Terminal Verification Results.
For cardholders, the practical advice is clear: physically destroy expired or replaced cards by cutting through the EMV chip and magnetic stripe, or return them through an issuer-approved disposal channel.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
