Researchers from the University of Massachusetts Amherst have discovered a way to revive expired contactless credit cards and use them to make unauthorized purchases, according to a paper presented at the USENIX Security 2026 conference this month. Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza detailed the vulnerability in their research titled "Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments." The attack exploits gaps in how expiration dates are verified during contactless transactions, allowing cards that should no longer work to complete payments at certain terminals.
The vulnerability affects Visa contactless cards specifically, while Mastercard, American Express, and Discover configurations successfully resisted the attack during testing. The researchers used mobile phones acting as NFC proxies to intercept and alter transaction data between the card and payment terminal. Visa's payment kernel doesn't cryptographically bind the expiration date that the card sends to the terminal, creating an opening for manipulation. The card transmits an expiration date to the checkout terminal, but in the Visa contactless setup tested, that specific date wasn't covered by the card's digital signature, allowing someone positioned between the card and terminal to modify what the terminal receives while keeping the card's standard security checks intact.
"Our results show that Visa contactless transactions are susceptible to man-in-the-middle tampering due to a lack of effective integrity protection," the authors state in their paper. The researchers explain that wallet Card Transaction Qualifiers settings push transactions toward online authorization checks rather than immediately rejecting the transaction, which transfers the enforcement responsibility to the card issuer where responses vary. Lead author Raja Hasnain Anwar, a doctoral candidate at UMass Amherst, told The Register that the attack's success hinges on how individual banks handle the transaction—some of the banks tested were vulnerable, while others weren't. The authors notified Visa of their findings in May 2025 and followed up in December 2025, but neither Visa nor the affected banks have confirmed they've addressed the expiration issue.
The security gap stems from how the EMV contactless protocol handles data authentication. The transaction process between a payment card and point-of-sale terminal relies on NFC communication linked to a payment network that connects the merchant to a bank and card issuer. According to the researchers, this protocol is fragile because the transaction flow is selectively authenticated—some data travels between the card and terminal in plaintext and only later gets linked to cryptographic verification through Offline Data Authentication and issuer-verified cryptograms. Visa's kernel allows the point-of-sale terminal to evaluate processing restrictions based on the Application Expiration Date, but the card issuer depends on an expiration date from a different data field in the online authorization request. These two dates should be cryptographically tied together, but they're not, creating the vulnerability. Anwar explained that different card manufacturers use different protocols for contactless transactions, and design choices often involve compromises to ensure backward compatibility with older terminals and meet performance standards. The security checks exist, he noted, but only a subset gets invoked to make transactions faster and smoother, frequently leaving room for this type of vulnerability. The research team demonstrated the attack works in real-world conditions, though success depends on the specific bank's authorization practices rather than being universal across all Visa contactless cards. Organizations relying on card expiration as a security control may need to reconsider how effectively that mechanism actually functions in contactless payment environments. Institutions balancing transaction speed against verification rigor will likely face growing pressure to revisit those architectural choices as attack techniques become more accessible.