Zombie Credit Cards: expired NFC chips still work in stores

Researchers at UMass Amherst presented at USENIX Security 2026 a flaw letting expired contactless cards still pay in stores. A relay using two smartphones and emulator software rewrites the expiration date before it reaches the POS terminal, since many banks rely on the terminal's partial check; Visa Kernel 3 is affected while Mastercard, Amex and Discover resist it.

• Attack needs two smartphones and emulator software to rewrite the card's expiry date
• Visa Kernel 3-style protocols are affected; Mastercard, Amex and Discover resist
• Fix requires end-to-end cryptographic signing of the expiration date
• Consumers should physically destroy the EMV chip, not just the magnetic stripe