A team from the University of Massachusetts Amherst has shown that a contactless credit card keeps working past its printed expiration date, even after the cardholder gets a replacement. They named it the Zombie Card attack and presented the findings at USENIX Security 2026. “This work is motivated by documented patterns of improper expired card handling. Although issuers instruct cardholders to destroy expired cards after replacement, cardholders routinely underestimate this risk precisely because expired cards are assumed to be inactive,” researchers wrote. Credit card accounts don’t expire along with the physical card, so a return still gets refunded even after the purchasing card has expired. That’s what led Muhammad Taqi Raza, assistant professor in the Riccio College of Engineering at UMass Amherst, to ask: “If the card can get a refund, can the card make a payment?”

Full report : Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments.