Research: Zombie Card Attack Revitalizes Expired Visa Cards

Researchers from the University of Massachusetts Amherst have developed a new attack method that allows expired Visa credit cards to be reactivated for contactless payments. The attack, referred to as the "Zombie Card," exploits a vulnerability in the communication between the card and the point-of-sale (POS) terminal. By manipulating the read expiration date, the cards can be used for legitimate purchases without compromising the underlying cryptography of the card. The researchers conducted their tests in real retail environments to demonstrate the effectiveness of the attack, finding that the method works with both physical and virtual POS terminals.

Attackers require physical access to the card to perform the manipulation, which limits the execution of the attack to specific scenarios. The technique relies on the use of Near Field Communication (NFC), a technology employed in many modern payment systems. By deliberately sending data to the POS terminal, attackers can alter the card's expiration date, allowing the terminal to accept the card as valid. This occurs without needing to bypass the card's security protocols. The researchers have identified and documented the vulnerability in the communication between the card and the terminal.

This vulnerability could potentially affect not only Visa cards but also other contactless payment systems that utilize similar technologies. The results of the study were published in a scientific journal and could have far-reaching implications for security standards in payment transactions. Security research has gained importance in recent years, particularly concerning contactless payment methods. Given the increasing use of NFC payments, it is crucial to identify and address potential vulnerabilities. The "Zombie Card" technique could serve as a wake-up call for banks and payment service providers to review and strengthen their security measures.

The researchers have already contacted Visa and other relevant institutions to discuss the findings of their study. A swift response from the affected companies is expected to ensure the security of their systems. Implementing updates or changes to security protocols may be necessary to prevent similar attacks in the future. The study has also attracted the attention of security analysts and professionals examining the impact of such attacks on retail and consumers. Experts warn that the proliferation of this technique could lead to an increase in fraud cases if appropriate measures are not taken.

The need to enhance the security of contactless payments is considered urgent. The researchers have emphasized that the "Zombie Card" technique is not merely a theoretical concept but has been tested in practice. The ability to reactivate expired cards could be of significant interest to criminals. Therefore, it is essential for industry security standards to be continuously monitored and updated. The publication of the study has already sparked discussions within the financial and security community.

Experts are calling for a comprehensive review of current security protocols for contactless payments. The relevance of this research is underscored by the rising use of contactless payment methods in recent years. The researchers have announced plans for further investigations to analyze the impact of the "Zombie Card" technique on other payment systems. The findings could help develop new security measures to prevent future attacks. The study was published on August 15, 2026.