Zombie cards: expired plastic still pays because nobody owns the expiry check

A team from the University of Massachusetts Amherst has shown that a contactless credit card keeps working past its printed expiration date, and keeps working after the cardholder has been sent a replacement; they call it the Zombie Card attack and presented it at USENIX Security 2026 ^[1]. The finding matters less as a cryptography result than as an accountability one: a contactless payment crosses the card, the terminal, the acquiring bank, the network and the issuer, and each party holds only a fragment of the decision about whether the card should still work ^[7].

The starting observation is mundane. Card accounts do not expire when the plastic does, which is why a return still gets refunded on an expired card ^[18]. Muhammad Taqi Raza, assistant professor in the Riccio College of Engineering at UMass Amherst, asked the obvious follow-up: "If the card can get a refund, can the card make a payment?" ^[19] With Raja Hasnain Anwar and Gerard DeCunha, he found the answer is yes for at least some cards ^[2].

The rig is two ordinary smartphones using the same NFC stack as tap-to-pay ^[3]. One phone wakes the expired card and reads its payment data, including the stale date; the second, linked over Wi-Fi, rewrites the date and presents it to the terminal ^[4]. Anwar says almost any future date works, because the date is not cryptographically protected and is "the only way for the POS to know whether a card is active or expired" ^[10]. To a cashier it looks like a digital-wallet tap ^[6]. Per the team's project page, the altered field sits outside what the card's signature covers in the affected setup, so the cryptographic checks still pass ^[11].

That is a Visa-specific gap in these tests. The researchers write that "Visa contactless transactions are susceptible to man-in-the-middle tampering due to a lack of effective integrity protection" ^[12], while Mastercard, American Express and Discover configurations each rejected the altered date because their expiry data is bound to a cryptographic check ^[5] -- three of the four network configurations tested ^[16].

Issuer behaviour mattered as much. Against one major US bank, the reworked expired card completed lab purchases at $1, $100 and $500, then live purchases of $2.79 and $3.19 at retail and grocery merchants ^[8]. That bank only confirmed the account existed and the card number was active, never whether that specific card instance was the one on file ^[9]. A second bank declined every attempt and prompted the cashier to ask for the replacement card ^[20].

Two structural details explain why the issuer is flying blind. In Visa's Kernel 3, the field that would flag an expired card to the issuer is reset to all zeros before transmission, so the bank cannot see that the terminal's own check would have failed ^[13]. And cards carry a second expiry inside the certificate securing card-to-bank communication, typically valid well past the printed date because issuers build in renewal overlap ^[17].

Replacement is no cleaner. One test card had been swapped out early for having under three months of validity left, and both the old card and its replacement kept working on the same account ^[14].

Watch the disclosure timeline: the researchers notified Visa and the affected banks in May and December 2025 with a reproduction guide ^[15]. The fix that costs nothing is issuer-side card-instance binding, which one of the two tested banks already does ^[9][20]. Until then, "destroy your expired card" is not consumer hygiene advice, it is the control.