'Zombie' credit cards can still be used after expiry — and banks are to blame
Researchers at the University of Massachusetts Amherst have uncovered a critical security flaw in contactless payment systems that allows expired credit cards to be used for fraudulent purchases. The findings were presented at the USENIX Security 2026 conference.
The team, led by doctoral candidate Raja Hasnain Anwar and Assistant Professor Taqi Raza, demonstrated how "zombie credit cards" — cards that have passed their expiration date — can still complete point-of-sale transactions. The researchers managed to trick store card readers into approving payments from invalid cards, even after replacement cards had already been issued to the original account holders.
To execute the exploit, the team built a low-cost "man-in-the-middle" relay system using two off-the-shelf smartphones running basic emulator software. The first phone interacts with the physical expired card via near-field communication (NFC) to extract its primary account data. That information is then relayed via Wi-Fi to a second phone held against the store's payment terminal. During transmission, the software modifies the unencrypted expiration date to a future date. Crucially, an attacker does not need to know the true expiration date of the victim's new replacement card — any arbitrary future date will satisfy the terminal.
The vulnerability exists because many payment networks and issuing banks fail to re-verify the expiration date read by the terminal against their central databases during real-time authorization. While digital wallets like Apple Pay and Google Pay offer stronger protection through tokenization, standard contactless cards remain exposed. The researchers urge banks to implement mandatory server-side expiration date checks to close the loophole. The attack highlights a broader issue: the reliance on static data stored on the card itself, rather than dynamic verification by the issuer, leaves the system open to abuse even after a card is technically expired.
