Expired Visa Cards Vulnerable: Understanding the Zombie Card Attack on Contactless Payments
Introduction
Contactless payments have become a cornerstone of modern commerce, allowing consumers to complete transactions with a simple tap of a card or mobile device. While the convenience is undeniable, the underlying technology also introduces new security challenges. A recent discovery has highlighted a particularly unsettling vulnerability: the “Zombie Card Attack,” which enables fraudsters to revive expired Visa cards and use them for contactless payments. This article examines the incident, outlines the technical specifics, provides context on contactless payment security, explains why the issue matters, and looks ahead to the steps being taken to mitigate the risk.
What Happened
Security researchers uncovered that certain expired Visa cards could be re‑activated for contactless transactions, effectively turning them into “zombie” cards that continue to function after their official expiration date. The flaw stems from the way the card’s embedded chip stores and clears data. When a card expires, the issuer expects the chip to become inert, but in many cases the chip retains the original PAN (Primary Account Number), expiration date, and cryptographic keys. By exploiting this residual data, an attacker can craft a counterfeit tap that the payment terminal accepts as a legitimate transaction.
The attack proceeds in two stages. First, the fraudster extracts the necessary data from the expired card—often using a low‑cost RFID reader that can capture the card’s signal from a short distance. Second, the attacker programs a malicious device (or modifies a legitimate card) to replay the captured credentials, bypassing the terminal’s expiration check. Because contactless terminals typically rely on the card’s internal cryptogram rather than an external database lookup for expiration, the counterfeit tap is processed as if the card were still valid.
Initial reports indicate that the vulnerability has been demonstrated in controlled lab environments, but the researchers warn that the same techniques could be deployed in the wild, especially in high‑traffic retail settings where rapid, unattended transactions are common.
Key Details
The core of the Zombie Card Attack lies in the EMV (Europay, Mastercard, Visa) contactless protocol. While EMV mandates a “dynamic authentication data” (DAD) element for each transaction, the expiration check is performed locally on the card’s chip. If the chip does not invalidate the DAD after the expiration date, the terminal receives a seemingly fresh cryptogram and proceeds with the payment. Researchers found that many Visa cards issued before a 2020 firmware update still contain this flaw, affecting millions of cards worldwide.
To exploit the vulnerability, an attacker needs three ingredients: (1) physical proximity to an expired Visa card with a functional contactless antenna, (2) a device capable of reading and rewriting the card’s data (often a modified NFC reader or a programmable “card‑cloner”), and (3) a payment terminal that does not enforce additional backend checks, such as real‑time verification of the card’s status against the issuer’s database. The attack can be executed in under a minute, making it feasible for opportunistic thieves in crowded environments.
Importantly, the issue is not limited to a single card series. The researchers’ analysis covered a broad sample of Visa cards issued across multiple regions, revealing that the flaw persists in both debit and credit products, as well as in some co‑branded cards that incorporate additional loyalty features.
Background
Contactless payments have surged in popularity since the early 2010s, driven by the rollout of EMV chip technology and the convenience of tap‑to‑pay. By 2023, over 70 % of card‑present transactions in many developed markets were contactless, and the COVID‑19 pandemic accelerated adoption as consumers sought touch‑free payment options. The EMV standard was designed to enhance security by generating a unique cryptogram for each transaction, reducing the risk of card‑present fraud compared to magnetic stripe cards.
However, the rapid deployment of contactless technology outpaced some aspects of security hardening. Early card firmware often prioritized speed and power efficiency over comprehensive data sanitization. As a result, certain legacy cards retained sensitive data beyond their expiration, creating an attack surface that was not fully anticipated by issuers or merchants. The Zombie Card Attack is a direct consequence of this legacy issue, underscoring the tension between convenience and robust security in payment ecosystems.
Why It Matters
Financial loss is the most immediate concern. If attackers can successfully use revived cards, victims may see unauthorized charges on accounts that they assumed were safe because the cards were no longer valid. For merchants, fraudulent transactions can lead to chargebacks, increased processing fees, and damage to brand reputation. Moreover, the attack bypasses many of the fraud‑prevention tools that rely on real‑time card status checks, rendering existing safeguards less effective.
Beyond the monetary impact, the vulnerability threatens consumer confidence in contactless payments—a technology that relies heavily on trust. A perception that expired cards can still be exploited may cause shoppers to revert to cash or chip‑and‑pin methods, slowing the adoption of faster payment solutions and potentially hindering the broader digital transformation of retail. Regulators and industry bodies may also respond with stricter compliance requirements, adding operational overhead for issuers and merchants alike.
What Happens Next
Visa has already issued an advisory to its member banks, urging them to roll out firmware updates that enforce strict expiration checks and to re‑issue cards that are known to be vulnerable. In parallel, payment terminal manufacturers are being asked to implement additional backend verification steps, such as real‑time queries to the issuer’s database to confirm card validity before authorizing a contactless transaction.
Consumers can mitigate risk by promptly destroying expired cards—cutting them into pieces or using a shredder—rather than simply discarding them. Cardholders should also monitor account statements for any unfamiliar activity and report suspected fraud immediately. As the industry patches the current flaw, experts anticipate a wave of similar investigations into other legacy card designs, prompting a broader push for “security‑by‑design” updates across the entire EMV ecosystem.
Conclusion
The Zombie Card Attack shines a spotlight on a hidden weakness in the contactless payment infrastructure: expired Visa cards that retain usable credentials can be resurrected for fraudulent use. While the technical exploit is sophisticated, its requirements are modest enough to pose a realistic threat. Addressing the issue will require coordinated action from card issuers, terminal manufacturers, merchants, and consumers. By updating firmware, enhancing verification protocols, and encouraging proper card disposal, the payment industry can close this loophole and restore confidence in the convenience of tap‑to‑pay technology.
đź“– See Also
đź“š Sources & Attribution
- âś“ Business Tech Weekly