How UMass Researchers Can Revive Expired Visa Credit Cards Using NFC Relays

Researchers at the University of Massachusetts Amherst have identified a vulnerability in the EMV contactless payment protocol that allows expired credit cards to authorize transactions. Detailed at the USENIX Security 2026 conference, the attack exploits a lack of cryptographic binding between expiration dates and transaction data, specifically within certain Visa contactless configurations. By utilizing NFC-enabled smartphones as a man-in-the-middle proxy, attackers can manipulate the expiration date presented to point-of-sale (POS) terminals, effectively reanimating “zombie” cards for unauthorized purchases.

Architectural Fragility in the EMV Kernel

The EMV (Europay, Mastercard, and Visa) standard relies on a complex chain of trust between the card, the POS terminal, and the issuing bank. According to the research paper “Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments,” the transaction flow is selectively authenticated. While Offline Data Authentication (ODA) provides some security, the protocol allows significant data to be transmitted in plaintext before cryptographic verification occurs.

The researchers, led by Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza, found that the issue is not universal across all card networks. While Mastercard, American Express, and Discover configurations successfully rejected the tampered expiration data, Visa contactless cards remained susceptible. This discrepancy arises because Visa’s kernel allows the POS terminal to evaluate processing restrictions based on an Application Expiration Date that is not cryptographically bound to the online authorization request. Consequently, if the issuing bank does not perform a secondary validation against the card’s lifecycle status, the transaction proceeds.

Man-in-the-Middle Implementation

The attack requires a bridge between the physical card and the POS terminal. Using two smartphones acting as NFC proxies, the researchers demonstrated a relay system that intercepts the card’s response. The first device queries the card for its payment application, while the second device presents a modified, “active” expiration date to the terminal. Because the terminal trusts the data provided during the NFC handshake, it initiates the transaction request.

# Conceptual NFC proxy modification for expiration date injection
def modify_expiration(data_packet):
    # Locate Application Expiration Date tag (e.g., 0x5F24)
    # Rewrite date to a future timestamp
    new_date = "2030-12-31" 
    updated_packet = replace_tag(data_packet, tag=0x5F24, value=new_date)
    return sign_and_forward(updated_packet)

As Taqi Raza, assistant professor in the Riccio College of Engineering at UMass Amherst, noted, this bypass is effective because the account itself does not expire when the physical card does. The system assumes the cardholder would have received a replacement, but the underlying payment network often lacks the logic to reject a “zombie” card if the terminal signals a valid expiration date.

Mitigation and IT Triage

Despite notifying Visa in May and December of 2025, researchers report that no widespread mitigation has been confirmed. The trade-off between transaction speed and security remains a persistent challenge in the EMV ecosystem, as noted by Anwar: “Often, these design choices end up in a compromise to ensure backward compatibility with old POS terminals, and also to meet their performance criteria.”

Disclaimer: The technical analyses and security protocols detailed in this article are for informational purposes only. Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.