Researchers from the University of Massachusetts Amherst have demonstrated an attack called Zombie Card that allows contactless payments using certain expired Visa cards over NFC. The technique does not require breaking cryptography or cloning the card; it relies solely on inconsistencies in how terminals and banks verify the card’s expiration date.
The team presented their findings in a paper at USENIX Security. For the experiment, researchers placed two Android smartphones between an expired card and a payment terminal. One device emulated the card while the other emulated the terminal, relaying data in real time. During the transaction, the system intercepted the EMV field containing the expiration date and replaced the expired value with a future date.
The terminal accepted the card after performing its local check. The cryptographic data for the transaction remained valid because the modifiable expiration field in Visa EMV Kernel 3 is not always cryptographically bound to the protected elements. However, the attack has limitations: the card’s keys must still be active, and the linked account and card number must remain operational.
Bank behavior varied during testing. One issuer approved payments of varying amounts at different merchants, while another issuer consistently rejected the transactions and directed customers to obtain new cards. Similar substitution attempts failed on Mastercard, American Express, and Discover because their implementations either cross-checked multiple representations of the expiration date or protected the relevant data cryptographically.
The attack is more complex than conventional skimming because it requires both a physical expired card and an NFC relay positioned near the payment terminal.
