Many believe that once a payment card expires, it's useless. Chip-and-PIN technology and cryptographic validation supposedly render an expired card incapable of completing transactions. So, why bother destroying it?
The Reality of Expired Cards
Researchers at the University of Massachusetts Amherst have shown that expired Visa contactless cards can still make purchases without breaking cryptographic protections. The "Zombie Card" attack manipulates the expiration date read by a point-of-sale terminal over NFC, while keeping the card's signatures intact.
This attack doesn't break encryption or forge certificates. Instead, it exploits a fundamental inconsistency. The expiration date appears twice in a Visa contactless transaction and is read by different parties. Visa's Kernel 3 doesn't require these two representations to be consistently bound.
The terminal checks Tag-Length-Value tag 5F24 (Application Expiration Date), while the issuer derives expiry from tag 57 (Track 2 Equivalent Data). A relay can rewrite the terminal-facing date to any future value, leaving Track 2 untouched. The card's Dynamic Data Authentication signature still validates because tag 5F24 isn't included in the signed data.
Your expired card can pass offline data authentication because issuer and card certificate lifetimes are set independently of application expiry. Kernel 3 specifies that Terminal Verification Results sent to the issuer are all zeros, so your bank can't see if the terminal ran or failed its local expiry check.
Testing the Vulnerability
The team tested this against five major US banks using physically expired and replaced cards. The results showed troubling policy differences.
Bank A allowed the expiration date modification and accepted transactions from multiple cards. Bank B detected the modification but accepted transactions from one active card. Bank D, using Discover's kernel, detected the modification yet still accepted transactions from multiple cards.
The revived card completed transactions of $1.00, $100.00, and $500.00 on the team's terminal, plus $2.79 at retail and $3.19 at a grocery store. These were real purchases against real merchant accounts.
The researchers also tested four EMV contactless kernels:
- Visa Kernel 3: The edit passed processing restrictions and didn't invalidate the signature.
- Mastercard Kernel 2: Declined due to a consistency check between the two expiry representations.
- American Express Kernel 4: Failed because the expiration date is bound into signed static data.
- Discover Kernel 6: Declined because Combined Dynamic Data Authentication binds card-returned TLV objects into the verified transaction hash.
Three out of four implementations caught the issue. Visa's did not.
The attack requires physical possession of the expired card or sustained NFC proximity, plus a man-in-the-middle relay. The relay added about 50 milliseconds with modification, staying within EMV's 500-millisecond-per-command limit. None of the cards or terminals tested implemented EMV's optional Relay Resistance Protocol, which would detect the added latency.
The findings were presented at the 35th USENIX Security Symposium in Baltimore from August 12 to 14, 2026. The team disclosed to Visa and affected banks in May 2025 and followed up in December 2025. As of August 20, 2026, Visa, EMVCo, and the card networks had published no advisory, specification bulletin, or mitigation guidance.
Steps to Take Now
If you're responsible for card issuing or acquiring, don't wait for network-level fixes. Implement these controls:
For issuers: Authorize against a PAN and expiry tuple. Treat the presented expiry as part of the credential identity. Decline if it doesn't match the valid credential for that PAN. Don't assume the terminal validated expiry correctly.
For acquirers and terminal vendors: Check the two expiry representations against each other. Compare the value the terminal consumes against the one in issuer-facing data. Provide issuer-visible evidence where they diverge.
For compliance teams: Review your card lifecycle procedures. When issuing a replacement card, ensure your authorization logic doesn't accept transactions from the expired card under the same Primary Account Number.
For cardholders: Destroy the chip and magnetic stripe of expired cards. Physical destruction is the only reliable control when cryptographic validation won't catch the modification.
Understanding the Conventional Wisdom
The conventional wisdom isn't entirely wrong, just incomplete.
Cryptographic validation prevents most tampering. The attack can't forge the card's signature or the issuer's cryptogram. It can't change the Primary Account Number. It doesn't work against Mastercard, American Express, or Discover implementations that bind expiration data into authenticated structures.
The conventional wisdom is right that this attack has a high barrier. You need physical card access, custom relay hardware, and an account that remains open under the same PAN. No exploitation has been reported in the wild.
However, the conventional wisdom assumes consistency. It assumes that if cryptography protects one field, it protects all critical fields. It assumes that if one network's kernel catches the modification, they all do. It assumes that if the terminal validates expiry, the issuer can trust that validation.
The Zombie Card attack shows these assumptions don't hold. Your expired card isn't cryptographically weaker than your active one. It's just less monitored.
