Zombie Card Attack Revives Expired Visa Cards

Executive Summary

Security researchers from the University of Massachusetts Amherst have developed and demonstrated a proof-of-concept (PoC) attack named "Zombie Card." This attack method allows an expired Visa contactless credit card to be used for making unauthorized in-store purchases. The attack works by using a man-in-the-middle (MitM) relay to intercept the communication between the card and the point-of-sale (POS) terminal, modifying the expiration date in transit. The technique successfully bypasses the terminal's offline checks without breaking the card's cryptography, enabling fraudulent transactions. The findings were presented at the 35th USENIX Security Symposium.

Vulnerability Details

The Zombie Card attack exploits a discrepancy in how a Visa contactless card communicates its expiration date during a transaction. The card transmits this information in two different formats. The attack specifically targets and modifies one of these formats, Tag-Length-Value tag 5F24, which is read by the POS terminal. The other format, which is used for online authorization with the card issuer, is left unchanged.

Attack Prerequisites:

• Physical possession of, or close and sustained proximity to, the target's expired Visa contactless card.
• A MitM relay system, which the researchers implemented using two NFC-enabled Android phones running custom software.

Attack Flow:

1. The attacker positions one phone near the victim's card and the other phone near the POS terminal.
2. When a transaction is initiated, the first phone reads the data from the expired card.
3. The data is relayed to the second phone.
4. The custom software on the second phone intercepts the 5F24 tag containing the expiration date and modifies it to a future date.
5. The modified data is then presented to the POS terminal.

Because the terminal sees a valid expiration date, it approves the transaction, especially for small amounts that rely on offline authorization. The entire process adds only ~70 milliseconds, which is well within the 500ms EMV standard, thus evading detection by latency checks.

Affected Systems

• Product: Visa-branded contactless (NFC-enabled) credit and debit cards.
• Environment: In-person retail transactions at POS terminals that support contactless payments and may perform offline authorization for small amounts.

Exploitation Status

This is a proof-of-concept attack developed by academic researchers. There is no evidence that the "Zombie Card" technique is being used by criminals in the wild. However, the underlying principle of relay attacks for payment fraud is a known and active threat. The researchers disclosed their findings to Visa and affected banks in May 2025, but no public advisory or fix has been issued as of August 2026.

Impact Assessment

While the attack requires close physical proximity, it poses a tangible risk for lost or stolen expired cards. An attacker could potentially drain small amounts from multiple expired cards before the fraud is detected. The primary risk is financial fraud. The success of the attack demonstrates a weakness in the EMV contactless protocol's offline validation process, which could be exploited by more sophisticated criminal groups if the technique were to be weaponized.

Detection Methods

• For Consumers: Monitor bank statements for any transactions occurring after a card's expiration date.
• For Issuers/Acquirers: Analyze transaction data for patterns indicative of relay attacks. While latency is hard to detect in this specific PoC, other data points from the full transaction log sent for clearing might reveal discrepancies between the card's true data and what the terminal recorded.

Remediation Steps

• For Consumers: The best practice remains to physically destroy expired credit cards by cutting through the chip and magnetic stripe.
• For the Payment Industry: The vulnerability lies within the EMV protocol's handling of offline data. A potential long-term fix would require a protocol-level change to ensure all cryptographic data elements are consistently validated, or to reduce reliance on offline authorizations. Card issuers could also implement more stringent server-side checks during the clearing process to flag transactions on expired cards, even if they were approved offline.