Full Report
Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale (POS) terminal reads over near-field communication (NFC), without breaking any of the card's cryptography. The attack, which the researchers named "Zombie Card," requires physical
Analysis Summary
# Vulnerability: Zombie Card (NFC Expiry Date Bypass)
## CVE Details
- **CVE ID:** None assigned (as of August 2026)
- **CVSS Score:** N/A (Estimated Medium to High due to financial impact)
- **CWE:** CWE-345: Insufficient Verification of Data Authenticity; CWE-295: Improper Certificate Validation
## Affected Systems
- **Products:** Payment cards and Point-of-Sale (POS) terminals utilizing Visa's contactless protocol.
- **Versions:** Visa Kernel 3 (EMV contactless implementation).
- **Configurations:**
- The account must remain open under the same Primary Account Number (PAN) after card expiration.
- The issuing bank must fail to independently verify the expiration date during the online authorization request.
- Specifically impacts Visa; Mastercard (Kernel 2), Amex (Kernel 4), and Discover (Kernel 6) were found to have protections that block this specific technique.
## Vulnerability Description
The "Zombie Card" attack exploits a logic flaw in how Visa Kernel 3 handles the card expiration date during contactless (NFC) transactions. In a standard transaction, the expiration date is represented in two places:
1. **Tag 5F24 (Application Expiration Date):** Read by the POS terminal to perform local processing restrictions.
2. **Tag 57 (Track 2 Equivalent Data):** Sent to the issuer for online authorization.
The researchers discovered that in Visa's implementation, Tag 5F24 is **not cryptographically protected** by the fast Dynamic Data Authentication (fDDA) signature. An attacker using a Man-in-the-Middle (MitM) relay can rewrite Tag 5F24 to a future date. Because the terminal's verification results are sent to the issuer as all zeros, the bank cannot see that the terminal's local check was manipulated. Furthermore, the card's internal RSA certificates often have a longer lifetime than the printed expiration date, allowing the card to still pass offline data authentication.
## Exploitation
- **Status:** PoC available (demonstrated by UMass Amherst researchers). No known exploitation in the wild.
- **Complexity:** Medium (Requires custom card/POS emulator software and a relay setup).
- **Attack Vector:** Physical (Requires physical possession of an expired card or sustained NFC proximity to one).
## Impact
- **Confidentiality:** Low (Does not expose primary card secrets).
- **Integrity:** High (Allows unauthorized modification of transaction metadata to bypass security checks).
- **Availability:** None.
## Remediation
### Patches
- No formal patches or specification updates have been released by Visa or EMVCo as of August 2026.
### Workarounds
- **Issuer-Side Verification:** Banks should ensure their authorization systems strictly validate the expiration date provided in the authorization request against their internal records, rather than relying on terminal-side checks.
- **Card Cancellation:** Fully deactivate expired PANs when a replacement card is issued, though this is often impractical for recurring billing.
## Detection
- **Indicators of Compromise:** Transactions originating from cards known to be expired or replaced.
- **Detection Methods:** Financial institutions can detect this by cross-referencing the "Track 2" expiry date sent in the authorization packet with the actual expiry date on file for that PAN. If they match an expired record but the transaction is processed as "current," it may indicate a Zombie Card relay.
## References
- USENIX Security '26 Paper: hxxps://www[.]usenix[.]org/system/files/usenixsecurity26-anwar[.]pdf
- UMass Amherst Research: hxxps://www[.]umass[.]edu/news/article/when-zombie-credit-cards-attack-umass-researchers-discover-loophole-can-reanimate
- The Hacker News Article: hxxps://thehackernews[.]com/2026/08/zombie-card-attack-can-revive-expired[.]html