Zombie Card: An expired Visa credit card can be used for purchases

Researchers demonstrated a weakness in Visa Kernel 3 contactless processing that can allow a payment terminal to be tricked into accepting a forged future expiration date — effectively reviving expired Visa contactless cards for real in‑store purchases (coined “Zombie Card”). The issue did not reproduce across tested Mastercard, American Express, and Discover kernels; exploitation scenarios include theft or recovery of discarded/replaced cards or more complex relay attacks, and recommended mitigations include physically destroying expired cards and issuer/terminal integrity protections.