Expired credit cards revived by researchers to make unauthorized payments

Researchers from the University of Massachusetts Amherst have uncovered a method to revive expired contactless credit cards and make unauthorized payments, a discovery presented at the USENIX Security 2026 conference. In their paper titled "Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments," authors Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza detail their findings.

Credit cards typically have expiration dates, but the researchers discovered that the way expiration dates are checked and enforced is inconsistent. They devised an attack that makes expired contactless cards appear valid to payment terminals. The Europay, Mastercard, and Visa (EMV) payment process involves a card and a point-of-sale terminal communicating over a direct NFC channel.

The EMV contactless protocol, however, is considered fragile due to selectively authenticated transaction flow, which leaves an opening for unwanted interference. The researchers demonstrated that they could meddle with Visa contactless transactions, making them vulnerable to man-in-the-middle tampering due to a lack of effective integrity protection.

Visa's kernel allows the point-of-sale terminal to evaluate processing restrictions based on the Application Expiration Date, but the card issuer relies on a different expiration date in the online authorization request. These two dates are not cryptographically bound, allowing the attack to succeed. The researchers' findings show that Visa contactless cards are susceptible to this type of attack, while Mastercard, American Express, and Discover configurations resisted it.

The authors notified Visa of their findings in May 2025 and December 2025, but neither Visa nor the banks involved have confirmed that they've addressed the issue.