How the Zombie Card Attack Revived Expired Visa Contactless Cards

During that exchange, the relay altered the expiration date supplied to the terminal. A past date could be replaced with a future date, so the terminal’s local checks treated the card as current. The reported demonstration required possession of the physical card, or continued NFC proximity to it, as well as the relay positioned between the card and the terminal.

The important distinction is that the relay did not need to counterfeit the card’s secret keys. The genuine card continued to produce the signed and dynamic transaction material expected by the EMV process. The weakness was the ability to change one decision-relevant field—the expiration date—without invalidating the other authenticated data.

What Visa EMV Kernel 3 exposed

The reported problem involved inconsistent treatment of the expiration date in Visa’s EMV contactless Kernel 3 implementation. In the tested setup, the date presented to the payment terminal was not sufficiently cryptographically bound to the card data and transaction information later used for authorization.

That created a mismatch:

1. The physical card supplied genuine payment data, including its actual, expired date.
2. The relay changed the date visible to the terminal.
3. The card still generated authentic transaction authentication material.
4. The terminal could therefore evaluate a future date while receiving cryptographically valid evidence from the real card.

In other words, the attack targeted the relationship between fields, not the cryptography itself. A signature or transaction cryptogram can remain genuine while a separate value used by the terminal is manipulated if the protocol does not bind those values together tightly enough. The researchers’ findings describe this as a man-in-the-middle tampering weakness in the Visa contactless transaction flow.

Why an expired card could still produce a valid transaction

Card expiration is often treated as though it were an intrinsic cryptographic shutdown. The available research summary indicates that this is not always how contactless payment systems enforce it. Some checks may depend on what the terminal receives and what the issuer can independently verify during authorization.

If the terminal sees a future expiration date and the issuer receives otherwise authentic transaction evidence, the system may lack a dependable, consistently authenticated signal that the physical card has expired. The account must also remain usable for an authorization to succeed; the attack does not turn a closed account or invalid account into an active one.

What happened with Mastercard, American Express, and Discover?

The supplied reports say that the same expiration-date substitution did not succeed in the tested Mastercard Kernel 2, American Express Kernel 4, and Discover Kernel 6 configurations.

However, the available evidence does not provide a full kernel-by-kernel protocol analysis explaining exactly which field bindings or validation steps caused those transactions to fail. The cautious conclusion is that the tested implementations rejected this particular manipulation more effectively than the tested Visa configuration—not that every card issued under those brands is immune to relay attacks or other payment fraud.

What did the bank testing show?

The research was reported as involving cards from multiple major U.S. banks, and coverage describes successful or attempted transactions across multiple issuers.

The available source material does not identify all five banks or provide a verified approval-and-decline result for each one. It would therefore be misleading to publish a bank-by-bank table or claim that one issuer universally accepted or rejected the attack. Results can depend on the card product, account status, authorization controls, terminal, acquirer, and transaction conditions.

Visa disclosure and remediation status

One supplied report says the researchers disclosed the findings to Visa and affected banks in May and December 2025, including reproduction material, transaction records, and a demonstration video.

The available sources do not include a verifiable Visa statement, a confirmed security advisory, or evidence of a completed remediation rollout. That means there is not enough evidence to say that Visa has fully fixed the issue, which cards or terminals are covered, or whether any mitigation is mandatory across the payment ecosystem.

Recommended defenses across the payment chain

The central fix is to prevent the terminal-facing expiration date from diverging from the authenticated card data.

• Payment networks and kernel designers: Cryptographically bind the expiration date and other terminal decision inputs to the authenticated card data and transaction cryptogram. Inconsistent values should cause the transaction to fail.
• Terminal and acquirer operators: Cross-check expiration information wherever it appears in the EMV exchange and investigate inconsistencies. Relay detection based on timing or communication behavior may provide an additional signal, although the supplied material does not establish a universal detection method.
• Issuers: Check expiration, replacement, and card-lifecycle status independently during authorization instead of relying solely on a terminal-supplied date. Transactions involving expired or superseded credentials should be declined or flagged when the issuer has enough information to identify them.
• Card programs: Ensure that replacement-card workflows consistently deactivate or restrict predecessor credentials when appropriate.
• Consumers: Monitor account activity and report unauthorized transactions promptly. An expired physical card should not automatically be assumed harmless if the underlying account or credential remains active.

How to dispose of an expired payment card safely

Consumers should follow the issuer’s instructions first, especially if the issuer requests that the old card be returned. Otherwise, remove the card from saved merchant accounts and digital-wallet applications, confirm that the replacement is active, and destroy the old card so its payment details cannot be reconstructed easily.

Cut through the chip, magnetic stripe, printed card number, signature panel, and security code. A cross-cut shredder designed for payment cards is preferable to leaving the card intact. If practical, discard the pieces separately. These steps reduce exposure from discarded card data, but they do not replace account monitoring or reporting an unfamiliar transaction to the issuer.