What the UMass Amherst team demonstrated
Researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza from the Khwarizmi Lab at UMass Amherst presented an attack, called "Zombie Card," that can revive expired Visa contactless cards for real in‑store purchases by rewriting the expiration date the POS terminal consumes over NFC, without breaking the card's cryptography. The attack requires either physical possession of the expired card or sustained NFC proximity, plus a man‑in‑the‑middle (MitM) relay positioned between the card and the terminal. It also depends on the account remaining open under the same primary account number (PAN) and on the issuing bank not independently re‑checking expiry during authorization.
Why Visa's Kernel 3 permits the modification
The paper explains that card expiry appears twice in a Visa contactless transaction and those representations are consumed by different parties: the terminal uses the Application Expiration Date (TLV tag 5F24) for local processing restrictions, while the issuer derives expiry from Track 2 Equivalent Data (tag 57) in the online authorization request. Visa's Kernel 3 does not require these two fields to be cryptographically bound, and the fast Dynamic Data Authentication (fDDA) signature the terminal verifies excludes 5F24 entirely. The relay edits the terminal‑facing 5F24 to a future date and leaves Track 2 untouched, so the card's signature and issuer‑verified cryptogram still validate. As Anwar put it in a university release, "Yet it is not cryptographically protected. So we can easily modify it to fool the POS."
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildHow other kernels and the testbed behaved
The team evaluated four contactless EMV kernels and reported different outcomes:
- Visa (Kernel 3): The edited expiry passed the terminal's processing restrictions and did not invalidate the signature, because 5F24 is not among the signed data.
- Mastercard (Kernel 2): The terminal checks consistency between the two expiry representations during READ RECORD parsing and treats a mismatch as a card data error, declining rather than falling back online.
- American Express (Kernel 4): The expiration date is part of the static data covered by offline data authentication, producing a hash mismatch if modified.
- Discover (Kernel 6): Combined Dynamic Data Authentication binds card‑returned TLV objects into the verified transaction hash, and modified transactions were declined.
The relay implementation used two NFC‑capable Android phones running custom card‑emulator and POS‑emulator software over Wi‑Fi and was tested with SumUp Solo and SumUp Plus readers. Each APDU round trip added an estimated 20 milliseconds for relay and 50 milliseconds when performing the modification, producing an average per‑transaction latency of about 415 milliseconds versus the EMV per‑command limit of 500 milliseconds. None of the physical cards or terminals in the testbed implemented EMV's optional Relay Resistance Protocol (RRP), which would bound permissible response time and could detect added latency.
Mitigations the paper recommends and disclosure status
The authors set out countermeasures aimed at kernels, terminals, and issuers: bind expiry‑critical data into an issuer‑verifiable signature or kernel‑defined transaction hash; have terminals compare their consumed expiry (5F24) against issuer‑facing expiry (track data) and surface divergences to issuers; require issuers to authorize against a PAN‑and‑expiry tuple and decline when the presented expiry does not match the credential on file; and preserve terminal validation signals so expiry‑related outcomes reach the issuer rather than being hidden. For cardholders, the guidance is to destroy the chip and magnetic stripe of expired cards rather than discard them intact, and to keep monitoring a closed account.
The team disclosed the findings to Visa and the affected banks in May 2025 and made contact again in December 2025. The work was presented at the 35th USENIX Security Symposium (August 12–14, 2026). The paper records that Visa's initial triage passed and the issue is undergoing reproduction by Visa's red team; the authors state that "neither Visa nor the notified banks has provided any update on the status or nature of mitigations" as of the paper's acceptance. No CVE has been assigned and no exploitation of the technique has been reported. The Hacker News found no advisory, specification bulletin, or mitigation guidance published by Visa, EMVCo, Mastercard, Discover, American Express, or terminal vendor SumUp as of August 20, 2026.
What this means for issuers, terminal vendors, and cardholders
- Issuers and acquirers: The paper urges treating the presented expiry as part of the credential identity (authorize against PAN+expiry) and ensuring issuer‑visible evidence when terminals perform local expiry checks, because Kernel 3 can hide a terminal's local outcome by forwarding all zeros in Terminal Verification Results.
- Terminal vendors and kernel maintainers: Vendors should consider cryptographically binding the terminal‑consumed expiry (5F24) to data covered by offline data authentication or otherwise making mismatches visible to issuers; SumUp readers in the testbed did not implement EMV's optional RRP, which could have flagged relay latency.
- Cardholders: The practical advice in the paper is to destroy the chip and magnetic stripe of expired cards and to continue monitoring accounts after a replacement card is issued, because an old physical card can still complete transactions when the account remains open under the same PAN.
A related note: Group‑IB documented an Android NFC relay malware family it calls WindRelay, deployed alongside the SpyNote RAT in social‑engineering campaigns in Czechia, Slovakia, and Slovenia. Group‑IB said it found 23 samples on VirusTotal between November 2025 and July 2026 and identified four C2 IP addresses; that malware relays an active card in real time and does not alter the expiration date, but uses the same two‑device relay primitive the Zombie Card testbed depends on.
The researchers published sanitized transaction logs but did not release the relay and MitM implementation; the paper carries USENIX's artifact evaluation badge marked Available. The Hacker News has reached out to Visa and to the researchers for further comment and said it will update the story with any response.
