-
Researchers demonstrated the Zombie Card attack, which modifies terminal-facing expiration dates over NFC to reuse expired Visa cards for live purchases.
-
The exploit succeeds because Visa Kernel 3 excludes the terminal expiration date tag from fast Dynamic Data Authentication signatures, leaving it unencrypted.
-
Mitigating this vulnerability requires card networks to cryptographically bind expiration fields and forces issuing banks to verify expiration dates during account authorization.
Researchers at the University of Massachusetts Amherst have uncovered a serious security vulnerability that allows threat actors to reuse expired credit cards for live in-store purchases.
The exploit tricks points-of-sale terminals into accepting invalid cards by altering digital records over near-field communication signals without breaking underlying cryptographic signatures.
The attack targets how payment hardware reads card information during contactless taps. Security analysts successfully completed live transactions using old physical cards that banks had already replaced with newer versions.
Technical Mechanics of the Zombie Card Exploit
In conventional contactless transaction processing, terminals scan the card expiry date through particular data tags. Application Expiration Date embedded inside Tag 5F24 is scanned by the POS for local transaction authorization.
The issuer bank then proceeds to verify the validity of the card. It checks the different sets of data within Track 2 Equivalent Data embedded in Tag 57. According to Visa Kernel 3 requirements, there is no binding of the two versions of the expiry date information during the offline validation stage by the terminals.
Furthermore, the fast Dynamic Data Authentication signature generated by the card completely excludes the terminal-facing expiration tag. Consequently, attackers positioning a man-in-the-middle relay between the card and terminal can rewrite the local expiration date to any future value.
The malicious relay device updates the terminal-facing date while leaving the bank-facing Track 2 data untouched. Because the card private key does not encode expiration constraints, the altered transaction passes terminal processing checks without invalidating the cryptographic signature.
A similar pattern of advanced technical exploitation has emerged in satellite communications. Israeli cyber firms have reportedly developed tools that track Starlink users without hacking the satellite network, using data fusion techniques that combine digital and geolocation records to map terminals and identify users.
The experimental setup required physical possession of the expired card and two near-field communication smartphones acting as relays. The phones communicated over local Wi-Fi connections, adding roughly 50 milliseconds of processing latency per transaction.
None of the tested payment terminals implemented relay resistance protocols, allowing modified traffic to complete before timing limits expired. Furthermore, the underlying bank account must remain open under the original primary account number for the exploit to succeed.
Varying Responses Across Major Banking Systems and Protocols
The research team tested their modification techniques across five major financial institutions in the United States. Testing revealed distinct policy differences among issuing banks rather than a uniform authorization standard across the payment industry.
One major institution, labeled Bank A, accepted modified expiration dates and allowed simultaneous transactions across multiple cards. The researchers successfully completed test purchases of one dollar, one hundred dollars, and five hundred dollars using an expired card at various merchant terminals.
In contrast, Bank B detected data modifications during transaction processing and declined the altered payment requests. A third institution, operating under Discover Kernel specifications, detected information tampering. But they still permitted multiple active cards to process charges against the same account.
The research team also evaluated four distinct payment kernels to determine how different card networks handle expiration edits. Mastercard Kernel 2 declined modified transactions immediately after detecting mismatches between the two expiration date fields during record parsing.
American Express Kernel 4 binds the expiration date directly into static data covered by offline signatures. This move caused instant hash validation failures when data changes. Discover Kernel 6 incorporates returned data objects into verified transaction hashes, which automatically blocks modified transaction attempts.
Additionally, researchers discovered that non-expired cards replaced early by issuers remained fully functional alongside their replacement cards. Both physical cards successfully executed transactions on Kernel 6 networks during the overlapping validity window without requiring any data modifications.
Proposed Countermeasures and Essential Industry Guidance
The authors displayed their findings at the 35th USENIX Security Symposium this August after revealing weaknesses to card networks in May last year. Payment networks have not published public security bulletins or mandatory protocol updates regarding the vulnerability.
Security experts recommend several technical adjustments across terminals, card kernels, and issuing bank servers to eliminate this risk. Card networks should cryptographically bind critical expiration data to issuer signatures to ensure offline data authentication fails during data tampering.
Payment terminals should also compare internal expiration fields against issuer-bound data before completing transactions. Terminals must flag any data discrepancies and pass detailed validation results directly to issuing banks during online authorization requests.
Furthermore, issuing banks should validate account authorization requests against complete data pairs combining account numbers with active expiration dates. Decline policies must trigger whenever presented expiration details fail to match current valid records on file.
It is vital for financial institutions to guard the terminal verification signals. This is because it would help in identifying any local validation errors easily through the back-end approval systems. Providing complete diagnostic signals is vital for the issuing banks. It ensures they stay informed of the local fraud taking place at the physical point of sale.
For an ordinary cardholder, the security experts recommend destroying physical chips and magnetic strips from old cards as soon as the new card arrives. Also, account holders need to keep track of the closed or replaced accounts regularly to catch any unusual charges at the earliest.
