# When Your Expired Visa Card Refuses to Die
Your old credit card sits at the bottom of a desk drawer, scissored in half, or maybe just tossed in the recycling bin. It expired two years ago. The bank issued you a new one. You're done with it.
Researchers at the University of Massachusetts Amherst would like to complicate that assumption.
A team there has demonstrated a contactless payment attack they're calling "Zombie Card" — and the name earns its drama. By manipulating a small slice of data that a point-of-sale terminal reads over NFC, they were able to revive an expired Visa contactless card and push through real in-store purchases. No cryptography was broken. No chip was cloned. The card was, by every institutional definition, dead — and it still worked at the register.
## The Expiration Date Was Always a Polite Fiction
Here's the thing that makes this attack cut deep: the expiration date was never truly enforced at the cryptographic layer. EMV chip transactions embed the card's validity period into the signed transaction data, making it tamper-evident. But contactless NFC communication introduces a separate, earlier step — the terminal reads basic card metadata before the cryptographic handshake happens. That metadata includes the expiration date, and on Visa cards, the researchers found it could be overwritten.
The attack doesn't break the cryptographic authentication. It sidesteps it entirely. The POS terminal sees a fresh expiration date in the NFC exchange, decides the card is valid, and proceeds with the transaction before the cryptographic checks that might have caught the anomaly come into play. It's the payment system equivalent of a bouncer checking the color of your wristband instead of reading it.
Physical access to the card is required — you can't do this over the air to a card still in someone's pocket. That's a meaningful constraint. But it's not a reassuring one. Cards get lost. Cards get stolen from wallets, mailboxes, apartments. Cards get found in trash cans and recycling bins by people who know exactly what to do with them. And expired cards, which people treat as harmless artifacts, are often disposed of with far less care than active ones.
## What the Terminal Gets Wrong
The root problem isn't a single bug in a single product. It's a structural tension in how contactless payments evolved.
EMV — the chip-and-PIN standard that replaced magnetic stripes — was designed to make card-present fraud cryptographically hard. And it largely succeeded. Skimming dropped. Counterfeiting dropped. The fraud migrated online, where card-not-present protections are weaker, but the physical card became a much harder target.
Contactless NFC payments were layered on top of EMV as a convenience feature. Fast. Frictionless. No PIN for small purchases. The tradeoff, as with most convenience features in security, is that some of the hardness gets traded away. Terminals need to make quick decisions about whether to even engage in a full transaction, and those early-stage decisions rely on metadata that isn't always held to the same cryptographic standard as the transaction itself.
The Zombie Card attack finds the seam between those two layers. The cryptography is fine. The pre-cryptographic conversation is where trust breaks down.
Visa isn't the only contactless scheme with this architecture, which makes the specificity of the UMass findings worth watching closely. If the attack surface is unique to Visa's implementation of NFC metadata handling, the fix is relatively contained. If it reflects a broader pattern in how NFC contactless exchanges are structured across schemes, the industry has a harder conversation ahead.
## Who Gets Hurt, and How
Chargebacks exist for a reason. Fraud victims generally aren't left holding the bill on disputed transactions — the liability typically falls on the issuing bank or, in some cases, the merchant. That's the safety net.
But the safety net isn't the point. Every fraudulent transaction that clears is a loss absorbed somewhere in the system, and those costs eventually surface as higher fees, tighter fraud controls, or friction added back into the checkout experience that contactless was supposed to eliminate. The Zombie Card attack, if it's reproducible at scale and doesn't require specialized equipment, could become a vector for organized retail fraud — the kind that exploits expired cards recovered through social engineering, dumpster diving, or mail theft before the victim ever knows they're exposed.
More unsettling is the attack's plausibility as a targeted threat. Someone with brief physical access to a card — a curious roommate, a dishonest repair technician, a hotel staff member — could potentially modify an active card's metadata without visible damage and without the cardholder having any idea until transactions start appearing from stores they've never visited.
## Visa's Response Is the Story Now
The researchers' findings have presumably been disclosed to Visa. What Visa does with that disclosure matters more at this point than the attack itself.
Terminal firmware updates can change how metadata is validated before proceeding. Issuer-side monitoring can flag transactions on cards with mismatched expiration dates against what's on file. Banks can add expiration date validation as a backend check rather than trusting the POS to do it correctly. None of these are simple at scale, but none are impossible either.
What would be damaging is if the response is slow, minimized, or buried in press-release language about how cardholder liability protections mean consumers are safe. They are — from direct financial loss. They're not necessarily safe from the fraud itself occurring, the account disruption that follows, or the time cost of disputing transactions they didn't make.
---
## HackWire Analysis
The Zombie Card attack lands at a moment when the payment security industry is quietly congratulating itself on how far it's come. EMV adoption is high. Magnetic stripe fraud is a fraction of what it was a decade ago. The contactless rollout went smoother than skeptics predicted. And then UMass Amherst publishes findings demonstrating that the expiration date — one of the most basic pieces of card validation, something your grandmother knows to check — can be manipulated at the NFC layer without touching the cryptography.
This fits a pattern that recurs across payment security: hardening one layer of the stack creates pressure on the adjacent layers. Chip-and-PIN hardened card-present transactions. Fraud moved to card-not-present. 3DS hardened card-not-present. Fraud moved to account takeover. Now, as EMV hardened the cryptographic core of contactless, attackers probe the pre-authentication envelope — the handshake before the handshake — and find it softer.
The physical access requirement will lead some to dismiss this as low-risk. That's a mistake. The security industry consistently underestimates attacks that require physical access until someone demonstrates those attacks at scale. Card skimmers required physical access too, once.
The more interesting question is whether Visa's response triggers a broader industry review of how NFC metadata is handled across all major card schemes, or whether this gets patched quietly and narrowly without pressure on Mastercard, Amex, and the rest to audit their own NFC metadata handling. Defenders — particularly fraud teams at large issuers — should be running retrospective checks on transactions from cards past their stated expiration date right now, today, regardless of how Visa classifies the disclosure severity.
— HackWire Editorial
---
## Related Coverage