What Happened
Researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza of the University of Massachusetts Amherst presented an attack at USENIX Security ’26 showing expired Visa contactless cards complete real point-of-sale purchases. The technique, named the Zombie Card attack, needs physical possession of the expired card or sustained near-field proximity to it, plus a relay device positioned between the card and the terminal. A second device intercepts the transaction data over the network, rewrites the expiration date field, and passes the altered data to the terminal, producing a transaction indistinguishable from a normal digital wallet payment. The attack works because card expiration in EMV contactless payments is enforced as a policy check performed by the terminal rather than a value cryptographically bound to the signed transaction data, so a tampered date passes the terminal’s check undetected. Testing found Visa cards vulnerable, while Mastercard, American Express, and Discover rejected the modified transactions.
Why This Matters for Canadian Organizations
Canada has one of the highest contactless payment adoption rates among major economies, with Visa a dominant network at retail terminals nationwide. A technique letting an expired or canceled Visa card continue making purchases creates fraud exposure for retailers accepting the transactions and for card issuers absorbing chargebacks and liability. Because the weakness sits in how terminals enforce expiration policy rather than in a single vendor’s software, no patch resolves the issue outright, leaving retailers and financial institutions dependent on Visa and terminal vendors to change how expiration checks work. Retailers processing payment card data carry obligations under PIPEDA to protect personal and financial information tied to transactions, and any resulting fraud losses or disputed transactions add operational and compliance burden regardless of where the underlying design gap gets fixed.
What to Do
Retailers and payment processors should watch for guidance from Visa and point-of-sale terminal vendors on mitigating the expiration-check weakness, and flag transaction patterns involving cards near or past their printed expiration date for manual review where feasible. Card issuers should evaluate migrating expiration enforcement into cryptographically protected transaction data rather than a terminal-side policy check. Full technical detail is available from The Hacker News and Help Net Security.
