Executive Summary
Researchers at the University of Massachusetts Amherst report the technical details of an attack vector that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale terminal reads over near-field communication, without breaking any of the card’s cryptography.
The attack, which the researchers named Zombie Card, requires physical possession of the expired card or sustained NFC proximity to it, plus a man-in-the-middle relay positioned between the card and the retail terminal. It also requires that the account remain open under the same primary account number, which is standard practice when an issuer sends a replacement card, and that the issuing bank not independently re-check the expiry during authorization. The revived cards successfully completed purchases at retail and grocery merchants on campus, indicating a direct threat to point-of-sale infrastructure in the retail sector.
Key Takeaways
- Card expiry appears twice in a Visa contactless transaction, and the two representations are consumed by different parties, with the retail terminal evaluating its processing restrictions against the Application Expiration Date carried in Tag-Length-Value tag 5F24. Visa’s Kernel 3 does not require the two to be consistently bound, and the fast Dynamic Data Authentication signature the terminal verifies excludes 5F24 entirely.
- The relay rewrites the terminal-facing date to any future value and leaves Track 2 untouched, so the card’s signature and its issuer-verified cryptogram both still validate during the retail transaction. The attacker does not need to know the replacement card’s real expiration date, as any date later than the transaction date is sufficient to bypass local terminal checks.
- An expired card still passes offline data authentication because issuer and integrated circuit card certificate lifetimes are set independently of application expiry and routinely outlast the printed date. The card’s private key encodes no notion of expiry at all, meaning an expired card that retains cryptographic capability can be revived for contactless transactions.
- Kernel 3 specifies that the Terminal Verification Results forwarded to the issuer are set to all zeros, so a bank cannot see whether the terminal ran or failed its local expiry check. Wallet Card Transaction Qualifiers settings steer expired transaction outcomes toward online authorization rather than a hard rejection, which increases reliance on issuer-side enforcement when the point-of-sale terminal suspects expiration.
- The attack remains operational under typical in-store conditions using commodity NFC transceivers and does not require specialized hardware, creating a highly practical threat vector for brick-and-mortar retail environments. Proposed countermeasures include checking the two expiry representations against each other and authorizing against a PAN and expiry tuple to ensure end-to-end transaction integrity.
