Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments

Researchers at the University of Massachusetts Amherst have demonstrated an attack that revives expired Visa contactless credit cards for real in-store purchases by rewriting the expiration date a point-of-sale (POS) terminal reads over near-field communication (NFC), without breaking any of the card's cryptography. The attack, which the researchers named "Zombie Card," requires physical

Reported facts: Researchers at the University of Massachusetts Amherst describe a 'Zombie Card' attack that can make expired Visa contactless cards work again in-store by manipulating the expiration date read by POS terminals over NFC, without breaking the card’s cryptography. This is a payment system integrity issue in the broader fintech security domain rather than an AI-specific vulnerability. RealGround analysis: While the attack targets NFC payment protocols, similar logic-manipulation techniques could apply to AI-driven fraud detection and transaction approval agents if they over-trust protocol metadata. Financial institutions should assess how AI systems consume payment data and audit business logic to prevent AI agents from authorizing transactions based on spoofable fields or incomplete validation.