An expired credit card sitting at the back of a wallet. Most people assume it's just a piece of plastic now—that while the account itself may still be active (refunds still land on expired cards), the physical card's ability to complete a transaction is gone.
That assumption, it turns out, doesn't hold—at least not for Visa's contactless cards. Three researchers at the University of Massachusetts Amherst (UMass Amherst)—Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza—have demonstrated an attack that "revives" an expired Visa contactless card using nothing more than two off-the-shelf smartphones and NFC relay software, completing a transaction at an actual point-of-sale terminal. Their paper, "Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments," was presented at USENIX Security 2026, held August 12–14, 2026.
The conditions required for the attack are strikingly minimal. The attacker doesn't need to know the new expiration date—any future date will do. All that's needed is the physical card itself and two smartphones connected over Wi-Fi.
A Crack in the EMV Fortress, Thirty Years in the Making
The EMV (Europay, Mastercard, Visa) standard was first published in 1996, designed to replace magnetic-stripe cards with chip cards. Managed by EMVCo, the standard is now used in more than 12 billion payment cards worldwide. With the spread of contactless payments, the EMV Contactless specification branched into brand-specific implementations known as "kernels." Visa runs Kernel 3 (payWave), Mastercard runs Kernel 2 (PayPass), American Express runs Kernel 4, and Discover runs Kernel 6.
EMV's security design rests on a two-layer structure: offline authentication (ODA, Offline Data Authentication) and online authentication (issuer cryptogram verification). In offline authentication, the card proves data integrity to the POS terminal via an RSA signature. In online authentication, a MAC (message authentication code) is generated based on a shared key between the card and the issuing bank.
The problem lies in a gap between these two layers—data protected by neither.
Only Visa's Kernel Left the Expiration Date Outside the Signature
According to the research team's analysis, in Visa Kernel 3's contactless transaction flow, the POS terminal determines card validity by referencing a data field called "Application Expiration Date" (tag 5F24). This field is read from the card but is not included in the scope of the card's digital signature (ODA).
Meanwhile, during online approval, the issuing bank references an expiration date contained in a different data field. Ideally, the date the terminal reads and the date the bank verifies should be cryptographically bound together—but in Visa's implementation, no such binding exists.
The researchers state in their paper: "Our results show that Visa's contactless transactions are vulnerable to man-in-the-middle tampering due to a lack of effective integrity protection."
Furthermore, the Card Transaction Qualifiers (CTQ) settings the card transmits are configured to route transactions to online approval rather than immediately rejecting expired-card transactions. This shifts the final decision to the issuing bank—but banks don't all respond the same way. At banks that don't cross-check the terminal-read expiration date against authenticated data, fraudulent transactions sail through approved.
Adding to the problem, the expiration date on the digital certificate (security key) embedded in the card is set later than the expiration date printed on the card's face. This means certificate-level verification alone cannot detect that the printed date has passed.
The Entire Attack, Completed With Two Smartphones
Here's how the attack works.
When the first smartphone is brought near the expired card, the card activates via NFC and transmits cardholder data and payment application data (including the expiration date). This data is relayed over Wi-Fi to the second smartphone. On the second smartphone, the attacker rewrites the Application Expiration Date to any arbitrary future date. When the second smartphone—now carrying the modified data—is tapped against the POS terminal, the terminal processes it as a valid card.
From the outside, it's indistinguishable from a normal tap payment via a digital wallet.
The research team confirmed the attack's success not only in the lab but also at real restaurants and grocery stores. Whether the attack ultimately succeeds depends on the issuing bank's verification logic—some of the banks tested approved the transaction, while others rejected it.
Why Mastercard, Amex, and Discover Held Up
The reason this attack worked only against Visa's kernel comes down to differences in design philosophy across the various kernels. In the Mastercard, American Express, and Discover kernels, the expiration date is either included in cryptographically protected data, or logic is implemented to immediately reject expired transactions.
| Item | Visa Kernel 3 | Mastercard / Amex / Discover |
|---|---|---|
| Cryptographic protection of expiration date | None (outside ODA signature scope) | Present, or transaction rejected immediately |
| Terminal behavior on expired card | Routed to online approval via CTQ settings | Transaction rejected |
| Attack outcome | Succeeds (bank-dependent) | Fails |
| Equipment required | Two off-the-shelf smartphones + NFC relay software | Same (but ineffective) |
In an email to The Register, Anwar explained the background behind this divergence: "These protocols standardize most messages to ensure global acceptance across different types of terminals. However, each manufacturer makes its own design decisions about additional mechanisms. In many cases, these design decisions are the product of a compromise that prioritizes both backward compatibility with legacy POS terminals and performance benchmarks."
A tradeoff between performance and security. The very "speed" demanded of contactless payments worked to narrow the scope of cryptographic protection.
Prior Research Points to a Structural Problem: EMV's "Selective Authentication"
This is not the first vulnerability of its kind. In 2023, David Basin, Patrick Schaller, and Jorge Toro-Pozo of ETH Zurich presented an attack at USENIX Security 2023 that bypassed PIN authentication in Mastercard contactless transactions. That attack also used the same two-smartphone man-in-the-middle (MITM) architecture, exploiting a specification quirk in which the terminal ignores subsequent authentication failures once offline authentication fails early.
In 2024, Anwar and colleagues themselves presented "In Wallet We Trust" at USENIX Security 2024, exposing vulnerabilities in digital wallet authentication, authorization, and access control. They demonstrated—across major banks including Chase, AMEX, and Bank of America—cases where payments succeeded via digital wallets even for locked or reported-stolen cards.
In 2025, Pavlides et al. presented "More is Less: Extra Features in Contactless Payments Break Security" at USENIX Security 2025, analyzing how additional features in contactless payments degrade security.
| Year | Research Team | Target | Attack | Conference |
|---|---|---|---|---|
| 2023 | Basin et al. (ETH Zurich) | Mastercard | PIN bypass (CVM List tampering) | USENIX Security '23 |
| 2024 | Anwar, Hussain, Raza (UMass Amherst / Penn State) | Digital wallets generally | Fraudulent payments with locked cards | USENIX Security '24 |
| 2025 | Pavlides et al. | EMV contactless generally | Security degradation via extra features | USENIX Security '25 |
| 2026 | Anwar, DeCunha, Raza (UMass Amherst) | Visa contactless cards | Reviving expired cards | USENIX Security '26 |
For four years running, "selectively authenticated data" in EMV contactless payments has become an attack target. Individual vulnerabilities differ, but the root cause is shared: rather than uniformly encrypting the entire protocol, the design decision to let some data flow in plaintext for the sake of faster transactions keeps creating an opening for MITM attacks.
More Than a Year After Disclosure, No Fix Confirmed
The research team notified Visa of the discovery in May 2025 and followed up in December of the same year. As of The Register's reporting (August 18, 2026), Visa had not immediately responded to a request for comment. No banks that were notified have confirmed that the expiration date issue has been fixed.
Fixing the EMV standard would require a specification change from EMVCo, implementation updates across each kernel, and rollout to POS terminals worldwide. The fact that Visa's specification sets no global upper bound on card expiration dates also makes simple checks on the terminal side difficult. Visa's official documentation (Transaction Acceptance Device Guide) states explicitly: "Because Visa does not place a global maximum on card expiration dates, POS devices should not validate whether the expiration date is too far in the future. This type of validation could lead to false declines."
Questions That Remain
This demonstration succeeded with a specific combination of bank and POS terminal—it does not mean the attack works against every Visa contactless card or every bank. Success depends on the issuing bank's online approval logic. What the paper demonstrated is a structural possibility—"under this design, whether the attack succeeds depends on the bank"—not a documented case of actual fraud.
Many questions remain unanswered. If Visa were to implement cryptographic binding of the expiration date, would backward compatibility with legacy POS terminals be maintained? Is the design choice to set the digital certificate's expiration date later than the card's printed expiration date intentional, or an overlooked inconsistency? And how many users actually keep expired cards around instead of discarding them? The real-world threat level of this attack hinges on that number.
In UMass Amherst's press materials, Raza offers this advice to consumers: "Always dispose of expired cards. And even after fully closing an account, keep monitoring transactions on the closed account." Given that what you thought was just a piece of plastic might still be "alive," that's sound advice.