# Visa Kernel 3 EMV Protocol Flaw — Zombie Card Relay Attack Enables Expired Contactless Card Purchases

> Researchers from UMass Amherst demonstrated at USENIX Security 2026 that expired Visa contactless cards can complete real purchases via a man-in-the-middle NFC relay attack. The attack exploits how Visa Kernel 3 handles EMV expiration date fields: the terminal-facing Application Expiration Date (Tag 5F24) is not cryptographically bound to the issuer-facing Track 2 Equivalent Data (Tag 57), and modifying it does not invalidate the card's digital signature. Mastercard, American Express, and Discover were unaffected. No CVE assigned; Visa acknowledged and was reproducing the attack as of publication.

- **Published:** 2026-08-21T00:00:00Z
- **Last reviewed:** 2026-08-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2102
- **ID:** TL-2026-2102
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 4 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza from the University of Massachusetts Amherst Khwarizmi Lab presented the paper 'Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments' at the 35th USENIX Security Symposium (August 12-14, 2026). The attack demonstrates a fundamental design gap in EMV contactless payments: card expiration is enforced as a transaction policy check performed by the POS terminal rather than as a cryptographically verified property of the card itself.

The attack uses two off-the-shelf NFC-capable Android phones — a CardEmulator placed near the POS terminal and a POSEmulator placed near the target expired card — communicating over Wi-Fi to create a relay. During the Data Retrieval phase of the EMV transaction, the relay intercepts the card's READ RECORD response containing the Application Expiration Date (Tag 5F24) and modifies it from an expired date to a future date. The POS terminal sees a valid, unexpired card.

Visa Kernel 3 is uniquely vulnerable due to three structural weaknesses. First, Tag 5F24 is excluded from the Signed Dynamic Application Data (SDAD) — the RSA-based offline data authentication (fDDA) signature does not cover the expiration date, so modifying it does not break cryptographic verification. Second, Kernel 3 specifies that the Terminal Verification Results (TVR) forwarded to the issuer shall be set to all zeros (per Visa specification section B.1.1), preventing the issuing bank from ever learning that the terminal's local expiration check was bypassed. Third, the Card Transaction Qualifier (CTQ) settings for digital wallets (Apple Pay, Google Pay) steer expired transaction outcomes toward online authorization rather than hard rejection, deferring the decision to the issuer which receives a clean TVR.

The researchers tested across five major US banks using SumUp POS terminals. Bank A approved zombie transactions up to $500 in lab testing and completed real purchases of $2.79 at a retail merchant and $3.19 at a grocery merchant. Bank B detected the modification but accepted some transactions. A third bank tested on Discover's kernel detected the edit and declined. The attack also succeeded at most banks when the CDCVM (Consumer Device Cardholder Verification Method) flag was manipulated. Notably, the relay completes well within Visa's 500-millisecond command timing limit — the relay adds approximately 415ms average with ~50ms for date modification.

The underlying cause is that card expiry exists as two representations — Tag 5F24 for the terminal and Tag 57 (Track 2 Equivalent Data) for the issuer — and Visa Kernel 3 does not cryptographically bind them together nor ensure end-to-end integrity. Card certificates issued by banks often remain valid beyond the printed expiration date to accommodate reissue overlaps, so expired cards retain valid cryptographic keys to generate legitimate Authorization Request Cryptograms (ARQCs) for online authorization. Issuers that validate at the Account Level (checking only whether the PAN exists) rather than the Instrument Level (checking the specific card instance, expiry, and Application Transaction Counter) will authorize the modified transaction.

The findings were disclosed to Visa and affected banks in May 2025 with a follow-up in December 2025. Visa acknowledged the report and it passed initial triage, with Visa's red team undergoing attack reproduction. No fixes, CVEs, or mitigations had been publicly confirmed as of the paper's presentation at USENIX Security 2026. The paper recommends cryptographically binding Tag 5F24 into SDAD, removing the TVR zero-out in Kernel 3, enforcing issuer-side instrument-level validation (PAN-and-expiry combination rather than PAN alone), and ensuring end-to-end expiry consistency across all transaction participants.

## MITRE ATT&CK

- T1588.006 Obtain Capabilities: Vulnerabilities
- T1587.001 Develop Capabilities: Malware
- T1557 Adversary-in-the-Middle
- T1553.002 Code Signing
- T1685 Disable or Modify Tools
- T1078 Valid Accounts
- T1095 Non-Application Layer Protocol
- T1565.002 Data Manipulation: Transmitted Data Manipulation
- T1684.001 Impersonation

## Sources

- [Zombie Cards Back Online: Reviving Expired Credit Cards for Contactless Payments — USENIX Security 2026](https://www.usenix.org/system/files/usenixsecurity26-anwar.pdf)
- [Your Shredded Visa Card May Still Work at the Checkout — Security Affairs](https://securityaffairs.com/197663/hacking/your-shredded-visa-card-may-still-work-at-the-checkout.html)
- [Expired credit cards revived by researchers to make unauthorized payments — The Register](https://www.theregister.com/security/2026/08/18/expired-credit-cards-revived-by-researchers-to-make-unauthorized-payments/)
- [New 'Zombie Card' Flaw Lets Expired Visa Cards Make Contactless Payments — Cybersecurity News](https://cybersecuritynews.com/zombie-card-flaw-expired-cards/)
- [Researchers found a way to bring expired credit cards back from the dead — TechSpot](https://www.techspot.com/news/113546-researchers-found-way-bring-expired-credit-cards-back.html)
- [When Zombie Credit Cards Attack — UMass Amherst News](https://www.umass.edu/news/article/when-zombie-credit-cards-attack-umass-researchers-discover-loophole-can-reanimate)
- [Zombie Card Attack: Expired Visa Cards Could Still Make Payments — The Hacker News](https://thehackernews.com/2026/08/zombie-card-attack-can-revive-expired-visa-cards.html)
- [USENIX Security 2026 Conference Paper Page — Anwar, DeCunha, Raza](https://www.usenix.org/conference/usenixsecurity26/presentation/anwar)
- [Khwarizmi Lab — Expired Credit Cards Project Website](https://khwarizmilab.github.io/emvexpiredcards/)
- [EMV Relay Resistance Protocols — PayPass-RRP and PURE (USENIX Security 2024)](https://www.usenix.org/system/files/usenixsecurity24-coppola.pdf)
- [EMV Tag Reference — Tag 5F24 (Application Expiration Date)](https://emvlab.org/emvtags/show/t5F24/)
- [SoK: EMV Contactless Payment Security — arXiv](https://arxiv.org/pdf/2504.12812)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2102