Researchers Revive Expired Visa Contactless Cards by Rewriting the Date the Terminal Sees

An expired credit card is supposed to be a dead card. Three researchers at the University of Massachusetts Amherst found that, for Visa contactless payments, that depends on the bank.

In a paper presented at USENIX Security 2026 in Baltimore, Raja Hasnain Anwar, Gerard DeCunha and Muhammad Taqi Raza describe what they call a “Zombie Card” attack. Two Android phones act as an NFC relay between a card and a checkout terminal. When the card sends its Application Expiration Date, the relay swaps in a future date before passing it on. “Our results show that Visa contactless transactions are susceptible to man-in-the-middle tampering due to a lack of effective integrity protection,” the authors wrote.

The weakness sits in Visa’s Kernel 3, the software that runs Visa’s side of the EMV contactless protocol. That kernel leaves the expiration date the terminal reads out of the card’s offline signature, so altering it doesn’t break the cryptographic checks that follow. The issuer, meanwhile, works from a different expiry field in the online authorization request, and the two are not cryptographically tied together, The Register explained.

Banks decided the outcome

The team tested Visa, Mastercard, Discover and American Express cards from five major US banks, plus Apple Pay and Google Pay, using their own expired cards, commercial terminals and informed merchants, and paid every test charge in full, according to the project page. The Mastercard, American Express and Discover configurations rejected the altered date. With Visa, results varied by issuer: some banks declined the charge or asked for the replacement card, and others approved it.

The paper says banks “often rely on the POS terminal’s decisions and skip critical security checks during transaction authorization for faster payments.” Wallet settings known as Card Transaction Qualifiers also pushed suspect transactions toward online authorization instead of an outright rejection, shifting more of the burden onto issuers.

Anwar, a doctoral candidate, told The Register the trade-off is built into how card networks balance speed and compatibility with older terminals. “The security checks are in place, however, only a subset of these security mechanisms are invoked to make the transaction faster and smoother,” he said. “No design is inherently bad.”

The attack used commodity NFC hardware and worked under normal in-store conditions, but it still needs physical access to the expired card. The authors propose binding expiry fields to issuer-verifiable signatures and having issuers check the card number against its lifecycle state. They said they notified Visa in May 2025 and followed up that December; as of The Register’s report, neither Visa nor the banks had confirmed a fix.