Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments

Researchers at the University of Massachusetts Amherst have demonstrated a method to revive expired Visa credit cards for contactless payments by rewriting the expiration date on a POS terminal, bypassing standard cryptographic checks. The attack, dubbed "Zombie Card," requires a man-in-the-middle relay and a card that remains open under the same PAN. While the technique works with some terminals and issuers, others reject the modified expiry, highlighting a significant vulnerability in the contactless payment system. The research follows a separate report on Android NFC relay malware, WindRelay, used in social engineering attacks.