Researchers bring expired credit cards back from the dead — and it's bad news for your bank account

A team of researchers from the University of Massachusetts Amherst has demonstrated a method to exploit expired credit cards for unauthorized purchases. The findings were presented at the USENIX Security 2026 conference.

Assistant professor Taqi Raza and his co-authors discovered that when a credit card expires, the underlying bank account remains active — even after the cardholder has already received a replacement card. This gap led the team to test whether an expired card could still be coaxed into approving a transaction. The answer was yes.

The attack relies on a "zombie card" setup built from two off-the-shelf smartphones and basic emulation software. The first phone activates the expired card over NFC, the same short-range wireless technology used for tap-to-pay. The card is prompted to transmit its data, including its expiration date. A second phone then acts as a point-of-sale terminal, intercepting and processing the data in a way that tricks the system into ignoring the card's invalidity.

Not every card is affected, but the flaw sits deep within how contactless payments are verified, making exploitation more than just theoretical. The researchers emphasize that the attack can be carried out without physical access to the original card — only its data, obtained via NFC, is needed.

The vulnerability highlights a systemic issue: the disconnect between card expiration dates and the continued validity of the underlying account. While banks typically deactivate the physical card, the account remains open for recurring payments and refunds, creating a window for abuse. The UMass Amherst team suggests that card issuers should implement additional verification steps for expired cards, such as requiring online authorization or a one-time password for any transaction attempted with an expired credential.

The research adds to a growing body of work on contactless payment security, which has seen increased scrutiny as tap-to-pay adoption surges worldwide.