Beware Of Zombie Credit Cards That Work After Expiration

by Aaron Leong — Wednesday, August 19, 2026, 11:03 AM EDT

Credit payment on a POS terminal - Image: Nathana Reboucas via Unsplash

Researchers from the University of Massachusetts Amherst have uncovered a critical security flaw in contactless payment processing that allows expired credit cards to be reanimated and used for fraudulent purchases.

Presented at the USENIX Security 2026 conference, the UMass researchers demonstrated how "zombie credit cards," or cards that have expired, can be used to complete point-of-sale (POS) transactions. Led by doctoral candidate Raja Hasnain Anwar and Assistant Professor Taqi Raza, the team managed to spoof store card readers into approving payments from cards that were no longer valid, even after replacement cards had already been issued to the original account holders.

Because financial institutions allow active credit card accounts to accept incoming refunds on expired cards, the team wondered whether the flow of funds could be reversed. Their investigation showed that the expiration date stored on a card's chip is used by POS terminals to verify validity, but that metadata lacks any kind of cryptographic protection. Furthermore, the underlying digital security certificates within the cards often remain valid long after the printed expiration date has passed, allowing the terminal and card to establish encrypted communication.

The researchers found the loophole worked across a variety of point-of-sale terminals. - Image: UMass

To execute the exploit, the team built a low-cost, "man-in-the-middle" relay system using two off-the-shelf smartphones running basic emulator software. The first phone interacts with the physical expired card via near-field communication (NFC) to pull its primary account data. That information is relayed via Wi-Fi to a second phone held against the store's payment terminal. During the transmission, the software modifies the unencrypted expiration date to a future date. Crucially, an attacker does not need to know the true expiration date of the victim's new replacement card; any arbitrary future date will satisfy the terminal.

What the exploit exposes is that many payment networks and issuing banks fail to re-verify the terminal-read expiration date against their central databases during real-time authorization. While digital wallets offer better resilience due to additional cryptographic layers, physical tap-to-pay cards across several major networks proved vulnerable in real-world tests at local grocery stores and dining facilities.

The UMass team have already notified major card networks and financial institutions of the vulnerability. In the meantime, it is advised that consumers destroy old cards rather than casually discarding them, and that users demagnetize the strip and physically smash or cut the embedded microchip.