Researchers at UMass Amherst have shown that expired Visa contactless cards can be revived for fraudulent payments, not through a stolen card number but through a relay attack that exploits a gap in how expiration dates are validated at the point of sale.
The technique, which the team calls a “zombie card” attack, uses two smartphones with near-field communication capability. One phone reads payment data off an expired card, including its outdated expiration date. The second phone intercepts that data, rewrites the expiration date to a future one, and relays the altered information to a payment terminal. Because the expiration date on Visa’s contactless Kernel 3 implementation lacks cryptographic protection, the terminal accepts the tampered date as valid. The researchers, Muhammad Taqi Raza, Raja Hasnain Anwar, and Gerard DeCunha, tested the attack against Visa, Mastercard, American Express, and Discover, and found only Visa vulnerable; the other three networks rejected the altered dates because their systems apply stronger cryptographic checks. Their paper states plainly that “Visa contactless transactions are susceptible to man-in-the-middle tampering due to a lack of effective integrity protection.”
The original insight worth flagging for security leaders is not the specific card network involved, it is the design pattern: a field treated as informational rather than security-critical, with no integrity check, sitting inside a protocol otherwise built around cryptographic authentication. That is the same failure mode behind session and authentication bypass flaws like the Adobe Commerce session hijack disclosed earlier this month, and it is worth an internal audit question: does every field your systems trust for a security decision actually carry a check, or does one just look like it does? The researchers disclosed the flaw to Visa and affected banks in May and December 2025; as of publication no CVE had been assigned and no fix confirmed, which leaves the exposure open for anyone accepting Visa contactless payments today, a gap comparable to other authentication bypasses defenders are being asked to close on short notice.
Source: USENIX Security 2026
