Researchers show “Zombie Card” attack on expired Visa
By The BriefBrief
Researchers at the University of Massachusetts Amherst disclosed a security flaw that can let criminals use expired Visa contactless cards to make unauthorized in-store purchases. The “Zombie Card” method uses two smartphones as a relay to exploit how Visa links expiration dates between payment terminals and issuing banks.
WHO:Researchers at the University of Massachusetts Amherst
WHAT:Disclosure of a “Zombie Card” attack that can revive expired Visa contactless cards for unauthorized purchases using a two-smartphone relay.
WHEN:Aug 23, 2026
WHERE:Location not specified
WHY:The attack exploits a weakness in how Visa handles expiration dates in tap-to-pay transactions, allowing the terminal and issuing bank to see different expiration dates.
