The 'Zombie Card' Glitch is a Gateway Failure, Not a Research Curiosity

When researchers at the University of Massachusetts Amherst presented their paper, "Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments," at the USENIX Security 2026 conference, the technical community likely saw it as a fascinating proof of concept. But from where I sit—tracking the flow of fees and the reality of merchant risk—this isn't just a clever academic exercise, as first reported by The Register. It is a glaring indictment of the authorization logic within the Visa kernel and a massive liability for the merchants who trust these systems to vet their revenue.

As reported by The Register, researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza discovered a way to make expired contactless credit cards appear valid to payment terminals. By using mobile phones as NFC proxies to act as intermediaries, the team successfully meddled with the transaction flow to revive "dead plastic."

To understand why this is a catastrophe for the payment ecosystem, you have to look at where the security checks actually happen. According to The Register, the Europay, Mastercard, and Visa (EMV) process relies on a contactless protocol that is, in the words of the researchers, "fragile." The issue is that the transaction flow is only selectively authenticated. Some data moves between the card and the terminal in plaintext, and the cryptographic verification—via issuer-verified cryptograms and Offline Data Authentication (ODA)—happens later.

This creates a window for a man-in-the-middle attack. In the case of Visa, the researchers found that the kernel is more permissive than those used by American Express, Discover, or Mastercard. Specifically, Visa's kernel does not cryptographically bind the expiration date.

Here is the failure point: the card provides an expiry date for the point-of-sale (POS) terminal to read, but that specific date is not covered by the card's digital signature. This allows an attacker to alter the date the terminal sees while the card's other security checks remain seemingly valid. The terminal then processes the transaction based on this manipulated data.

But the real negligence occurs in the hand-off. The researchers noted that wallet Card Transaction Qualifiers steer these transactions toward online authorization checks rather than rejecting them immediately. This essentially shifts the responsibility for enforcement onto the card issuer. Because Visa's approach "kicks the authentication handling down the road," the success of the attack depends entirely on how the individual bank handles the request. The researchers found that some banks succumbed to the attack while others did not.

From a market perspective, this is a nightmare. When a payment gateway or a kernel allows a transaction to proceed to the bank despite a lack of cryptographic binding on a primary security field (the expiration date), they are creating a fraudulent settlement environment. If a merchant accepts a payment from a "zombie card" that the system erroneously validates, the merchant is the one exposed to the inevitable chargeback once the fraud is detected.

Lead author and doctoral candidate Raja Hasnain Anwar told The Register that these design choices are often made to ensure backward compatibility with old POS terminals and to meet performance criteria—essentially trading security for a "faster and smoother" transaction. But "smooth" is a cold comfort to a business owner facing a wave of fraudulent chargebacks because a payment giant decided that speed was more important than integrity protection.

It is particularly damning that the researchers claim to have notified Visa of these findings as early as May 2025, with a follow-up in December 2025. According to The Register, neither Visa nor the notified banks have confirmed that this expiration issue has been mitigated, and Visa did not respond to requests for comment.

This is not a "nuanced" trade-off; it is a failure of the authorization logic. If the expiration date—a fundamental pillar of card validity—is not cryptographically bound, the system is essentially operating on a trust model that is easily exploited by anyone with a mobile phone and the requisite knowledge. By failing to secure the integrity of the expiration check, Visa has left a backdoor open that transforms discarded plastic into a tool for unauthorized payments.

In the fintech world, we talk constantly about "frictionless" payments. But when you remove too much friction from the security layer, you aren't just improving the user experience; you are subsidizing fraud. The "Zombie Card" vulnerability proves that the current EMV implementation for Visa is insufficient. Until the expiration date is cryptographically bound and terminals are required to reject these transactions before they even hit the bank, merchants are operating in a state of systemic risk.