Researchers at the University of Massachusetts Amherst have shown how some expired Visa cards could be manipulated to make contactless payments after they should have stopped working.
The “Zombie Card” attack uses NFC relays to alter the expiry date seen by a payment terminal without breaking the card’s encryption.
Researchers demonstrated payments of US$1, US$100 and US$500, although success depended partly on the issuing bank’s checks.
The flaw affected the Visa contactless configuration tested, while Mastercard, American Express and Discover rejected the altered expiry information.
The attack requires physical possession of the expired card, making carelessly discarded cards a potential risk.
Businesses should securely destroy expired cards by cutting through the chip and magnetic stripe, while monitoring accounts for unexpected transactions.
