Unearthing the ‘Zombie Card’ Vulnerability
In a startling revelation that challenges the perceived security of contactless payments, researchers at the University of Massachusetts Amherst have unveiled a novel attack dubbed ‘Zombie Card’. This ingenious method allows expired Visa contactless credit cards to be resurrected for real-world, in-store purchases. The core of the attack lies in manipulating the expiration date read by a point-of-sale (POS) terminal via near-field communication (NFC), all without breaching the card’s underlying cryptography.
How the ‘Zombie Card’ Attack Works
The ‘Zombie Card’ attack is a sophisticated man-in-the-middle (MitM) relay operation. It necessitates physical possession of the expired card (or sustained NFC proximity) and a relay device positioned between the card and the terminal. Crucially, the account associated with the card must remain open under the same primary account number (PAN) – a common practice when a replacement card is issued. Furthermore, the issuing bank must not independently re-check the expiry date during the authorization process, a detail that proved pivotal in the researchers’ findings.
The attack exploits a specific nuance in how Visa contactless transactions handle expiration dates. A card’s expiry appears twice: once as the Application Expiration Date (Tag 5F24) for the terminal, and again in the Track 2 Equivalent Data (Tag 57) for the issuer’s online authorization request. Visa’s Kernel 3, the software implementation of the EMV protocol, does not mandate consistency between these two representations, and the fast Dynamic Data Authentication (fDDA) signature verified by the terminal entirely excludes Tag 5F24.
This loophole allows the MitM relay to rewrite the terminal-facing expiration date to any future value, leaving the issuer-facing Track 2 data untouched. Consequently, the card’s cryptographic signature and the issuer-verified cryptogram both remain valid, effectively ‘fooling’ the POS terminal into accepting an expired card. As Raja Hasnain Anwar, a doctoral candidate at UMass Amherst’s Khwarizmi Lab, explained, the expiration date is “not cryptographically protected,” making it vulnerable to modification.
Varying Success Across Card Networks
The UMass Amherst team‘s evaluation spanned five major US banks, with experiments involving expired and replaced physical cards covering three. Of these, one bank surprisingly approved the ‘revived’ transactions, another consistently declined them, and a third was operating on a different EMV kernel where the modification failed outright.
The researchers also tested the modification against four different EMV contactless kernels, revealing significant differences in their security implementations:
- Visa (Kernel 3): The modification passed, as Tag 5F24 is not part of the signed data.
- Mastercard (Kernel 2): The terminal performs a consistency check between the two expiry representations, treating a mismatch as a card data error and declining the transaction.
- American Express (Kernel 4):
The expiration date is a mandatory element bound into the static data covered by offline data authentication, leading to a hash mismatch and signature validation failure.
- Discover (Kernel 6): Combined Dynamic Data Authentication binds the card-returned TLV objects into the verified transaction hash, causing modified transactions to be declined.
Disclosure and Lack of Public Mitigation
The findings were presented at the 35th USENIX Security Symposium in Baltimore in August 2026. The researchers, Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza, responsibly disclosed their findings to Visa and the affected banks in May 2025, with a follow-up in December 2025. As of August 20, 2026, no CVE has been assigned, and no exploitation of this technique has been reported in the wild.
However, a concerning detail highlighted by The Hacker News is the absence of any advisory, specification bulletin, or mitigation guidance published by Visa, EMVCo, Mastercard, Discover, American Express, or terminal vendor SumUp. This lack of public guidance leaves a potential gap in understanding and addressing this vulnerability.
The relay system itself was constructed using two NFC-capable Android phones running custom software, demonstrating the feasibility of the attack with relatively accessible technology. While the attack introduces a slight latency (around 70 milliseconds per APDU round trip), none of the tested physical cards or terminals implemented EMV’s optional Relay Resistance Protocol (RRP), which could detect such delays. The successful transactions, including purchases of $1.00, $100.00, and $500.00, underscore the potential financial impact of this vulnerability.
For more details, visit our website.
Source: Link
Leave a comment