Zombie Card Attack Revives Expired Visa Cards

Researchers at the University of Massachusetts Amherst have developed a novel attack, dubbed "Zombie Card," that can revive expired Visa contactless credit cards for use in real in-store purchases. This exploit targets the near-field communication (NFC) protocol used for contactless payments, allowing a point-of-sale (POS) terminal to read a rewritten expiration date, effectively bypassing the card's expiry status. Crucially, the attack does not compromise the card's cryptographic security, meaning the underlying encryption remains intact, which complicates traditional detection methods.

The attack functions by manipulating the data transmitted during the NFC transaction. When a contactless card is presented to a POS terminal, it communicates various pieces of information, including the card number, transaction details, and the expiration date. The "Zombie Card" attack intercepts and modifies the expiration date data as it is being read by the terminal. This manipulation makes the expired card appear valid to the POS system, enabling a transaction to proceed as if the card were current. The researchers have detailed that this process requires physical proximity between the compromised POS terminal and the card, and it leverages the way certain POS devices process expiration date information.

This vulnerability highlights a potential blind spot in the security of contactless payment systems. While the cryptographic integrity of the card's chip is not breached, the attack exploits a logical flaw in how the expiration date is handled during the transaction. The implications are significant, as it could allow individuals to make purchases using cards that should no longer be active, potentially leading to fraudulent transactions and financial losses for both consumers and financial institutions. The research team has stated that their findings are intended to inform the payment industry about these vulnerabilities and encourage the development of more robust security measures to prevent such attacks.

The University of Massachusetts Amherst researchers have presented their findings, emphasizing the need for updated protocols and terminal software to address this specific attack vector. The success of the "Zombie Card" attack underscores the ongoing challenge of securing digital payment systems against evolving threats. Further research and industry collaboration are expected to focus on enhancing the validation processes at the POS terminal level to ensure that only genuinely valid and unexpired cards can be used for transactions, even in the presence of sophisticated data manipulation techniques.