Researchers find a loophole that lets expired credit cards make unauthorized payments

Researchers at UMass Amherst demonstrated the "Zombie Card" attack: a contactless-payment relay using two smartphones that activates an expired or replaced Visa card, intercepts its NFC payment data, rewrites the expiration date, and completes purchases because Visa Kernel 3 and some bank processes do not cryptographically bind or forward the card expiration check. The team validated the issue in lab and limited live transactions, responsibly disclosed to Visa and affected banks, withheld exploit code, and proposed fixes such as binding the expiration date cryptographically and sharing terminal checks with issuers.