"Our results show that Visa contactless transactions are susceptible to man-in-the-middle tampering due to a lack of effective integrity protection," the authors write, summing up research that demonstrates how expired contactless cards can be made to work again.
The attack: NFC proxies, man‑in‑the‑middle tampering, and revived expired cards
Researchers from the University of Massachusetts Amherst presented "Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments" at USENIX Security 2026, showing that expired contactless cards can be made to appear valid to payment terminals. The method uses mobile phones or small NFC proxy devices acting as intermediaries between a physical contactless card and a merchant point‑of‑sale (POS) terminal. Because parts of the EMV contactless exchange are transmitted in plaintext and only later linked to cryptographic checks, an intermediary that passes necessary messages but tampers with selected fields can change what the terminal sees without tripping the card’s internal security checks. The researchers recorded a video demonstration of the technique.
Visa's implementation gap: the unbound expiration date
The paper points to an implementation detail in the EMV contactless workflow that the researchers say creates the opening. EMV involves a direct NFC channel between a payment card (or a digital wallet) and a POS terminal, with transaction authorization ultimately routed through payment networks such as Visa, Mastercard and Discover to issuers. EMV functionality is implemented in vendor‑specific EMV kernels: American Express, Discover, Mastercard and Visa each run their own kernels.
According to the authors, Visa's kernel was permissive in the configuration tested: it does not cryptographically bind the expiration date that the POS terminal reads to the expiration date the issuer sees in the online authorization request. The terminal is allowed to evaluate processing restrictions using the Application Expiration Date, while the issuer relies on a different expiration field in the online request. Because those two dates are not tied together in the cryptographic signature, a positioned intermediary can alter the expiry date seen by the terminal while leaving the card’s own checks apparently valid. The authors note that wallet Card Transaction Qualifiers steer transactions toward online authorization rather than immediate terminal rejection, shifting enforcement to issuers.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWhat the researchers did and how they disclosed it
The paper is authored by Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza. The lead author, Raja Hasnain Anwar, identified himself as a doctoral candidate at UMass Amherst and told The Register via email that different card manufacturers make design choices—often to preserve backward compatibility and to meet performance criteria—that can leave room for vulnerabilities. "These protocols have most messages in common to ensure global acceptance on different types of terminals; however, each manufacturer has their design choices to make for additional mechanisms," he wrote. He added that security mechanisms are present but only a subset are invoked in configurations intended to make transactions faster and smoother, creating trade‑offs between performance and security.
The authors say they notified Visa of their findings in May 2025 and followed up in December 2025. As of the researchers' public presentation and as reported by The Register, neither Visa nor the banks tested have confirmed that they have mitigated the expiration‑date issue. Visa did not immediately respond to a request for comment in the reporting of the research.
What this means for card issuers and banks
The paper makes clear that the attack's success depends on issuer behavior. Because the Visa contactless configuration tested delegates certain checks to the issuer at authorization time, how an issuer implements online checks determines whether a tampered transaction will be accepted. The researchers tested multiple banks; "some of the banks tested succumbed, while others didn't." That variability means mitigation can come either from altering issuer authorization checks or from changing what is cryptographically bound and validated earlier in the transaction flow.
What this means for merchants, POS vendors, and cardholders
For merchants and POS vendors, the finding highlights a weakness in what terminals are permitted to rely on: terminals read an expiry date supplied by the card and may defer enforcement to online checks. For cardholders, the practical risk is that expired physical cards—those in wallets or discarded in bins—might be reused for contactless purchases if an intermediary can influence what the terminal sees. The researchers found that Mastercard, American Express and Discover configurations resisted their attack in the tests described, while Visa contactless cards did not. The authors also reference prior research showing issues with Mastercards in some configurations.
The Register’s writeup closed with a wry observation about discarded cards: "Let the dumpster dive for discarded cards begin." That captures an obvious, if unflattering, implication of the technique if it were deployed by opportunistic actors.
Neither the researchers nor their paper prescribe a single operational fix in the published material; the remaining open questions are procedural and institutional: will issuers change online authorization checks, will Visa alter its kernel bindings, or will merchants and terminal vendors shift which fields are enforced at the terminal? The authors disclosed their findings to Visa in 2025 and demonstrated the attack in public at USENIX Security 2026, but as of the public report neither Visa nor affected banks had confirmed mitigation.
