Zombie Cards Trick Terminals Into Accepting Expired Payments

A concerning security vulnerability has been revealed where expired contactless cards can still facilitate purchases. Researchers at the University of Massachusetts Amherst demonstrated that 'zombie cards' can be exploited to complete transactions at checkout terminals. This attack is possible because the expiry date read by terminals is not always protected by the card's digital signature, unlike the value seen by the issuer. This allows an intermediary device to alter the expiry date to a valid one, thereby bypassing security checks.

While this vulnerability has been shown to affect Visa contactless cards, other major networks like Mastercard, Discover, and American Express have reportedly rejected such altered transactions. The attack requires physical possession of the card and the use of two smartphones. Crucially, a protocol known as Relay Resistance, which can detect and thwart such relay attacks by measuring transaction timing, exists but remains optional and was not active on the tested equipment. Researchers notified Visa and relevant banks in May and December 2025, but as of the report's publication, no fix had been confirmed.