Expired contactless cards still clear in-store payments at banks that trust the terminal's expiry date

The trust boundary in this attack sits at the issuer. According to the dev.to write-up, the payment terminal does only a partial verification of the expiry date it reads. Many issuing banks rely on that check entirely and do not re-check the card's cryptographic expiration data on their own end, so a rewritten date gets approved ^[4].

Putting a future date in front of the terminal is the attacker's whole task. One phone picks up the expired card's NFC signal and relays it to a second phone at the store reader, and the date is rewritten to a future one before it reaches the reader ^[3]. The bill of materials is two standard smartphones and emulator software ^[3]. The account at the far end is still open. Issuers keep it active after the plastic expires so that merchant refunds and other incoming funds can land ^[2].

Credit to the three networks that held. Mastercard, American Express and Discover resisted the manipulation because their cards have built-in cryptographic data binding, the write-up says ^[5]. The attack primarily exploits specific contactless protocols, and the example it gives is Visa Kernel 3 ^[5]. Of the four networks named, three held up ^[12].

Card replacement is where an operating assumption breaks. The write-up says an expired card can still make in-store purchases even after a new one has been issued ^[1]. At an issuer that trusts the terminal's date, reissuing the card does not retire the old chip, and that chip still reaches a live account ^[14]. The evidence supports this for the affected protocol and for issuers that skip their own check. The write-up does not name the paper's authors or say how many issuers were tested, so its "many" is unquantified.

The long-term fix in the write-up is a mandated end-to-end cryptographic signature on the expiration date for every transaction ^[6]. Major card companies have been formally notified ^[15]. The write-up expects a global fix across legacy POS terminals and bank systems to take considerable time, leaving the loophole partly open in the short term ^[15]. I'd expect affected issuers to move first on their own side. An issuer that re-checks the cryptographic expiry data on its own end stops depending on the terminal's reported date, and that change does not wait on terminals in the field ^[13].

For cardholders, the advice turns on the chip. "The 'Zombie Card' exploit operates strictly through the wireless antenna of the embedded EMV chip," said Jarrod Wright, SVP Marketing at Chargebacks911 ^[11]. On the standard tip of slicing a card along the magnetic stripe, Wright said "it is completely irrelevant to this specific vulnerability" ^[7]. "Once the chip is severed, it is permanently dead, and the exploit is completely neutralized," he said ^[8]. The write-up also recommends digital wallets, which use device-bound, randomized tokens instead of the static card details on physical plastic ^[10].