Visa Kernel 3 EMV Protocol Flaw — Zombie Card Relay Attack Enables Expired Contactless Card Purchases
Visa Kernel 3 EMV Protocol Flaw (TL-2026-2102), also tracked as Zombie Card Attack, is a high-severity software vulnerability, first published 2026-08-21. It has no confirmed attribution, affects Visa Kernel 3 EMV Contactless Implementation, maps to 9 MITRE ATT&CK techniques (T1078, T1095, T1553.002), and is covered by 9 detection rules and 4 indicators of compromise.
Key facts for TL-2026-2102
- Threat ID
- TL-2026-2102
- Also known as
- Zombie Card Attack, Zombie Cards Back Online
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-08-21
- Last reviewed
- 2026-08-21
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- finance, retail, ecommerce
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 4
Malware and tooling in Visa Kernel 3 EMV Protocol Flaw
Malware and tooling: Custom NFC relay framework (CardEmulator + POSEmulator)
Researchers from UMass Amherst demonstrated at USENIX Security 2026 that expired Visa contactless cards can complete real purchases via a man-in-the-middle NFC relay attack. The attack exploits how Visa Kernel 3 handles EMV expiration date fields: the terminal-facing Application Expiration Date (Tag 5F24) is not cryptographically bound to the issuer-facing Track 2 Equivalent Data (Tag 57), and modifying it does not invalidate the card's digital signature. Mastercard, American Express, and Discover were unaffected. No CVE assigned; Visa acknowledged and was reproducing the attack as of publication.
How Visa Kernel 3 EMV Protocol Flaw works
Researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza from the University of Massachusetts Amherst Khwarizmi Lab presented the paper 'Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments' at the 35th USENIX Security Symposium (August 12-14, 2026). The attack demonstrates a fundamental design gap in EMV contactless payments: card expiration is enforced as a transaction policy check performed by the POS terminal rather than as a cryptographically verified property of the card itself.
The attack uses two off-the-shelf NFC-capable Android phones — a CardEmulator placed near the POS terminal and a POSEmulator placed near the target expired card — communicating over Wi-Fi to create a relay. During the Data Retrieval phase of the EMV transaction, the relay intercepts the card's READ RECORD response containing the Application Expiration Date (Tag 5F24) and modifies it from an expired date to a future date. The POS terminal sees a valid, unexpired card.
Visa Kernel 3 is uniquely vulnerable due to three structural weaknesses. First, Tag 5F24 is excluded from the Signed Dynamic Application Data (SDAD) — the RSA-based offline data authentication (fDDA) signature does not cover the expiration date, so modifying it does not break cryptographic verification. Second, Kernel 3 specifies that the Terminal Verification Results (TVR) forwarded to the issuer shall be set to all zeros (per Visa specification section B.1.1), preventing the issuing bank from ever learning that the terminal's local expiration check was bypassed. Third, the Card Transaction Qualifier (CTQ) settings for digital wallets (Apple Pay, Google Pay) steer expired transaction outcomes toward online authorization rather than hard rejection, deferring the decision to the issuer which receives a clean TVR.
The researchers tested across five major US banks using SumUp POS terminals. Bank A approved zombie transactions up to $500 in lab testing and completed real purchases of $2.79 at a retail merchant and $3.19 at a grocery merchant. Bank B detected the modification but accepted some transactions. A third bank tested on Discover's kernel detected the edit and declined. The attack also succeeded at most banks when the CDCVM (Consumer Device Cardholder Verification Method) flag was manipulated. Notably, the relay completes well within Visa's 500-millisecond command timing limit — the relay adds approximately 415ms average with ~50ms for date modification.
The underlying cause is that card expiry exists as two representations — Tag 5F24 for the terminal and Tag 57 (Track 2 Equivalent Data) for the issuer — and Visa Kernel 3 does not cryptographically bind them together nor ensure end-to-end integrity. Card certificates issued by banks often remain valid beyond the printed expiration date to accommodate reissue overlaps, so expired cards retain valid cryptographic keys to generate legitimate Authorization Request Cryptograms (ARQCs) for online authorization. Issuers that validate at the Account Level (checking only whether the PAN exists) rather than the Instrument Level (checking the specific card instance, expiry, and Application Transaction Counter) will authorize the modified transaction.
The findings were disclosed to Visa and affected banks in May 2025 with a follow-up in December 2025. Visa acknowledged the report and it passed initial triage, with Visa's red team undergoing attack reproduction. No fixes, CVEs, or mitigations had been publicly confirmed as of the paper's presentation at USENIX Security 2026. The paper recommends cryptographically binding Tag 5F24 into SDAD, removing the TVR zero-out in Kernel 3, enforcing issuer-side instrument-level validation (PAN-and-expiry combination rather than PAN alone), and ensuring end-to-end expiry consistency across all transaction participants.
MITRE ATT&CK techniques used in TL-2026-2102
Persistence
Command and Control
T1095 Non-Application Layer Protocol
defense-impairment
T1553.002 Code Signing; T1685 Disable or Modify Tools
credential-access
Impact
T1565.002 Data Manipulation: Transmitted Data Manipulation
Resource Development
T1587.001 Develop Capabilities: Malware; T1588.006 Obtain Capabilities: Vulnerabilities
stealth
Affected products and versions in Visa Kernel 3 EMV Protocol Flaw
- Visa — Kernel 3 EMV Contactless Implementation
Vulnerable versions: All versions of Kernel 3 as specified in VSDC Contact & Contactless U.S. Acquirer Implementation Guide - Multiple Major US Banks — Contactless Payment Authorization Systems (Account-Level Validation)
Vulnerable versions: Issuers validating at Account Level (PAN-only check) - Apple — Apple Pay via Visa Kernel 3
Vulnerable versions: All versions using Visa Kernel 3 CTQ settings - Google — Google Pay via Visa Kernel 3
Vulnerable versions: All versions using Visa Kernel 3 CTQ settings
Remediation for Visa Kernel 3 EMV Protocol Flaw
Immediate actions
- Issuers should validate transactions at the Instrument Level (checking PAN + expiry + ATC) rather than Account Level (PAN only)
- Cardholders should destroy expired cards by cutting through the chip and magnetic stripe before disposal; dispose of remains in separate trash receptacles
- Retailers and acquirers should verify that POS terminals are using EMV kernels that cryptographically bind expiry data
- Issuers should reject authorization requests where TVR indicates expired application was detected and overridden
Workarounds
- Disable contactless transactions on expired cards at the issuer level
- Implement issuer-side monitoring for transactions from cards with mismatched expiry dates across authorization fields
- Deploy POS terminals with additional verification of offline data authentication results
Longer-term hardening
- Visa must include Tag 5F24 in SDAD so the expiration date is covered by the card's RSA signature
- Visa must revise Kernel 3 specification to forward genuine TVR values to issuers rather than zeroing them out
- Payment networks should mandate end-to-end consistency between terminal-facing and issuer-facing expiry representations
- EMVCo should standardize cryptographic binding of lifecycle metadata across all kernels
- Consider deployment of relay resistance protocols (PayPass-RRP, L1RP, or UWB-based PURE) in POS terminals
- Certificate issuance policies should align certificate validity with card lifecycle and expiry dates
Weaknesses (CWE) in Visa Kernel 3 EMV Protocol Flaw
CWE-290, CWE-306, CWE-345, CWE-347, CWE-754, CWE-862
Timeline of Visa Kernel 3 EMV Protocol Flaw
- Researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza disclose the Zombie Card vulnerability to Visa and affected US banks, including detailed technical findings and attack reproduction steps
- Follow-up disclosure outreach to Visa; Visa acknowledges the report, it passes initial triage, and Visa's red team begins reproducing the attack
- Paper 'Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments' accepted at the 35th USENIX Security Symposium
- Researchers confirm the attack on SumUp POS terminals in controlled laboratory conditions using custom NFC relay software on two Android phones, validating the full APDU interception and Tag 5F24 modification chain
- Researchers conduct live field testing at retail merchants and grocery stores using their own expired and replaced Visa cards; successful real purchases of $2.79 at retail and $3.19 at grocery merchants completed at Bank A
- Paper presented at USENIX Security 2026 conference in Baltimore, MD; full technical details of the Kernel 3 vulnerability, relay architecture, bank testing results across five major US banks, and countermeasure proposals released publicly
- The Register publishes first major media coverage; Visa declines to comment on the record; no fixes confirmed
- TechSpot, UMass Amherst News, Cybersecurity News, and The Hacker News publish articles detailing the Zombie Card attack; UMass researchers issue cardholder disposal guidance (demagnetize strip, destroy chip, shred card)
- Visa has not deployed fixes; Kernel 3 continues to be deployed in millions of POS terminals globally; attack remains feasible for any attacker with two NFC-capable Android phones
- Security Affairs publishes coverage; attack remains unpatched with no CVE assigned and no confirmed mitigations from Visa; global impact across Visa contactless payment infrastructure
Sources cited for Visa Kernel 3 EMV Protocol Flaw
- Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments — USENIX Security 2026
- Your Shredded Visa Card May Still Work at the Checkout — Security Affairs
- Expired credit cards revived by researchers to make unauthorized payments — The Register
- New 'Zombie Card' Flaw Lets Expired Visa Cards Make Contactless Payments — Cybersecurity News
- Researchers found a way to bring expired credit cards back from the dead — TechSpot
- When Zombie Credit Cards Attack — UMass Amherst News
- Zombie Card Attack: Expired Visa Cards Could Still Make Payments — The Hacker News
- USENIX Security 2026 Conference Paper Page — Anwar, DeCunha, Raza
- Khwarizmi Lab — Expired Credit Cards Project Website
- EMV Relay Resistance Protocols — PayPass-RRP and PURE (USENIX Security 2024)
- EMV Tag Reference — Tag 5F24 (Application Expiration Date)
- SoK: EMV Contactless Payment Security — arXiv
Threats related to Visa Kernel 3 EMV Protocol Flaw
- AI-Assisted "HTTP Terminator" Uncovers Novel HTTP Desync Techniques and Apache Traffic Server Zero-Day (CVE-2026-63078)
- Bendix EC80 Truck Brake Controller: 2024 Safety Recall Covertly Patched RCE and DoS Vulnerabilities
- CVE-2026-8037: Pre-Authentication Remote Code Execution in Progress Kemp LoadMaster via escape_quotes() Heap Out-of-Bounds Read
Detection coverage for TL-2026-2102
As of 2026-08-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2102 across Splunk SPL, Microsoft KQL and Sigma, covering 4 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.