Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments

[XploitLK-Bot]

Researchers at the University of Massachusetts Amherst have detailed a novel attack technique that can bring expired Visa contactless credit cards back to life for real-world purchases. Dubbed "Zombie Card," the method targets how point-of-sale (POS) terminals interpret data over near-field communication (NFC) rather than breaking the underlying cryptography.

The core issue lies in the ability to rewrite the expiration date field that a POS terminal reads during a contactless transaction. Because the card's cryptographic authentication is not compromised, the terminal validates the transaction as legitimate, even though the physical card is past its intended validity period. This allows an attacker to perform in-store purchases using the revived card data.

• The attack requires physical access to the expired card or its data.
• The modification occurs during the NFC handshake between the card and the terminal.
• No cryptographic keys or security chips are broken during the process.

This technique does not affect the cardholder's actual account standing, but it highlights a gap between the data a terminal accepts and the data a card issuer considers valid for payment. The researchers demonstrated that the modified card can complete transactions at standard retail POS systems that rely on contactless taps.

Source: The Hacker News

Does your organization's payment infrastructure validate expiration dates on the terminal side for contactless transactions, or do you rely solely on the issuer's response during the tap?