Zombie Card Attack Shows How Expired Visa Cards Can Be Used

Researchers demonstrated that a Zombie Card attack can make a physically expired Visa credit card complete a contactless payment, simply by relaying a forged expiration date to the point‑of‑sale terminal. That surprise – a card that should be dead suddenly works – is the most counterintuitive thing about this story.

Key Takeaways

• The attack exploits a timing gap between the card’s NFC chip and the issuing bank’s verification system.
• Only Visa cards are vulnerable; Mastercard, American Express and Discover aren’t affected.
• Success depends on a smartphone relay that modifies the expiration date in real time.
• Visa hasn’t commented, leaving merchants in the dark about remediation.
• Developers of payment terminals may need firmware updates to close the loophole.

Zombie Card Attack: How It Works

The proof‑of‑concept hinges on a smartphone acting as a man‑in‑the‑middle between the card and the POS terminal. The phone’s NFC interface reads the card’s data, swaps the stored expiration date with a future value, and forwards the altered payload to the terminal. Because the terminal trusts the card’s cryptographic signature, it proceeds with the transaction, and the issuing bank later receives a request that appears legitimate.

That’s the catch: the attack doesn’t break any cryptographic algorithm. It simply feeds the terminal a different date than the one the chip originally presented. The researchers set up the relay in a lab, using a standard Android device and off‑the‑shelf NFC tools. It didn’t require any hardware modifications, which makes the technique frighteningly accessible.

In practice, the attacker would need physical proximity to the victim’s card – the same distance required for any contactless tap. Once the relay is in place, the smartphone can be hidden in a pocket or even mounted on a point‑of‑sale kiosk for repeated exploitation.

Technical Gap: The Communication Lag Between Hardware and Bank

Contactless payments rely on three moving parts: the card’s NFC chip, the merchant’s POS terminal, and the issuing bank’s back‑end authorization service. When a card is tapped, the terminal sends the card data, including the expiration date, to the bank for validation. The bank checks the date against its records and returns an approval or decline.

What the researchers uncovered is a narrow window where the terminal accepts the card’s data before the bank’s response arrives. If the attacker injects a fresh expiration date during that window, the terminal believes the card is still valid and completes the transaction. By the time the bank sees the request, the transaction has already been recorded locally.

That timing flaw is why the attack only works on Visa’s current implementation. Visa’s protocol permits the terminal to proceed with a provisional approval before the final response, whereas the other networks enforce stricter checks that block the transaction until the bank confirms the date.

Why Cryptographic Checks Still Pass

The card’s digital signature covers the PAN, expiration date, and a few other fields. When the smartphone swaps the expiration date, it also recalculates the signature using the card’s private key – which it can’t access. Instead, the attack uses a quirk: the terminal validates the signature after it has already accepted the transaction for processing. So the altered date slips through without triggering an immediate failure.

That’s why the researchers emphasized the need for terminals to perform verification before authorizing the payment. If the terminal rejected the transaction at the signature stage, the relay would have no effect.

Scope and Limitations: Not All Cards, Not All Banks

The study explicitly notes that the technique fails against Mastercard, American Express, and Discover cards. Those networks use different authentication flows that close the timing window the attackers rely on. the attack doesn’t work against every issuing bank; some Visa issuers already enforce stricter real‑time checks that would flag the altered expiration date.

That nuance matters. It means the threat isn’t a universal kill‑switch for all contactless payments, but it does expose a systemic weakness that could be weaponized against high‑volume merchants that rely heavily on Visa.

According to the original report, the researchers didn’t observe any successful real‑world exploits yet. The attack remains a lab demonstration, but the fact that it’s reproducible with off‑the‑shelf tools should set off alarms.

Industry Reaction: Silence From Visa, Unease From Merchants

When SecurityWeek reached out, Visa declined to comment. That silence isn’t surprising; companies often wait for a full internal assessment before speaking publicly. What’s concerning is that merchants get no guidance on whether their existing terminals are vulnerable.

Some point‑of‑sale providers have started reviewing their firmware, but there’s no coordinated patch rollout yet. For developers building custom payment solutions, the finding forces a rethink of the validation order: verify cryptographic signatures before any provisional approval.

Meanwhile, consumer advocacy groups are warning cardholders to monitor statements closely. If a fraudster manages to use a “zombie” card, the unauthorized charge could appear as a legitimate Visa purchase, making it harder for victims to dispute.

Mitigation Strategies for Developers and Merchants

There are three practical steps that can reduce exposure:

• Enforce post‑capture verification: Terminals should hold off on authorizing a transaction until the issuing bank confirms the expiration date.
• Update firmware: Vendors need to patch the timing logic that permits provisional approvals.
• Implement anomaly detection: Monitor for patterns where the same card is used repeatedly with different expiration dates.

Developers can also add a secondary check that compares the card’s expiration date with a locally cached list of known‑good dates for frequent customers. It’s not foolproof, but it adds a layer that the relay would have to defeat.

Merchants should contact their terminal providers and ask whether they’ve released a fix. If the provider can’t confirm a patch, they might consider swapping out older hardware that predates recent Visa specifications.

What This Means For You

If you’re a developer integrating Visa’s contactless API, you’ll need to revisit the order of operations in your payment flow. Make sure the cryptographic signature check happens before you send any provisional approval to the bank. That change will add a few milliseconds to the transaction, but it blocks the window the Zombie Card attack exploits.

For merchants, the immediate action is to audit your terminal fleet. Ask your vendor for the latest firmware version and verify that it includes a fix for “pre‑authorization before verification.” If you run a high‑volume retail operation, consider deploying a real‑time monitoring tool that flags repeated use of the same PAN with varying expiration dates – that’s a red flag for a potential relay attack.

Will Visa tighten its protocol to close the timing gap, or will attackers find a way around the new checks? Only, but the discovery forces the industry to treat contactless security with the same rigor it gives wired payments.

Historical Context of Contactless Payments

Contactless technology entered the consumer market as a convenience feature. Early implementations relied on a simple tap‑and‑go model, where the card’s NFC chip transmitted a static set of data. Over time, issuers layered dynamic data elements and cryptographic signatures to protect against cloning. Those enhancements made the system appear strong, yet they also introduced multiple validation points that must stay in sync.

Visa’s current specification reflects years of incremental updates. Each revision aimed to reduce friction while preserving fraud‑prevention controls. The trade‑off is a more complex handshake between the terminal and the issuing bank. When a handshake includes a provisional approval step, the system gains speed but also opens a narrow timing window. That window is the very gap the Zombie Card researchers exploited.

Other networks built their handshakes differently. Mastercard, American Express and Discover opted for a stricter “wait‑for‑bank‑confirmation‑before‑approval” flow. Those choices unintentionally shielded them from the timing‑based relay. The history shows that small design decisions can have outsized security implications years later.

Concrete Scenarios for Developers and Merchants

Understanding the abstract attack becomes clearer when you picture real‑world use cases. Below are three situations where the vulnerability could surface.

• Café with high‑turnover traffic: A barista sees a customer tap an expired Visa card. The terminal, running unpatched firmware, accepts the forged date and processes the coffee purchase. The bank later declines, but the café’s ledger already recorded a sale. The merchant must manually reconcile the mismatch.
• Pop‑up shop at a festival: Organizers use portable POS devices that often run older software versions. A malicious actor positions a hidden smartphone near the payment area, relays forged dates, and walks away with dozens of small purchases. Because the devices lack real‑time anomaly detection, the fraudulent activity blends into normal sales.
• Subscription‑based SaaS platform: The service stores a customer’s card details for recurring billing. If the stored card expires, the platform still attempts a charge each month. An attacker who has previously captured the card could use a relay to keep the subscription alive, causing the platform to record a successful payment while the issuer ultimately declines.

In each case, the root cause is the same: the terminal or backend system trusts a provisional approval before the bank’s final verdict. Developers can mitigate by inserting an explicit verification step in the code path. Merchants can reduce risk by ensuring their devices run the latest firmware and by monitoring for irregular expiration‑date patterns.

Key Questions Remaining

• Will Visa issue a formal protocol update that eliminates provisional approvals, or will it rely on firmware patches alone?
• How quickly can POS manufacturers roll out firmware updates to millions of deployed terminals?
• What detection mechanisms can issuers add to flag a sudden surge of transactions using the same PAN with mismatched expiration dates?
• Can attackers scale the relay technique beyond a single point of sale, perhaps by embedding smartphones in public kiosks?
• Will other networks adopt Visa’s timing model for performance reasons, potentially inheriting the same vulnerability?

Answers to these questions will shape the next wave of security hardening. Until then, developers, merchants and cardholders should treat contactless transactions with the same vigilance they apply to chip‑and‑pin purchases.

Sources: SecurityWeek, original report

Primary sources: github.com (Vendor advisory for CVE-2025-62593).