Researchers find a loophole that lets expired credit cards make unauthorized payments
Overview
Researchers at the University of Massachusetts Amherst have discovered a security flaw they call the 'Zombie Card attack,' which allows expired contactless credit cards to remain functional for unauthorized payments. Even after cardholders receive a replacement card, the old card can still be used, raising concerns about how expired cards are managed. The study emphasizes that many users do not follow issuer instructions to destroy expired cards, leading to potential misuse. This loophole poses a risk to both consumers and financial institutions, as it can facilitate fraud without the cardholder's knowledge. The findings were presented at the USENIX Security 2026 conference, prompting a call for better security practices around expired payment methods.
Key Takeaways
- Affected Systems: Contactless credit cards from various issuers (specific brands not mentioned)
- Action Required: Cardholders should destroy expired cards immediately upon receiving replacements to prevent unauthorized use.
- Timeline: Newly disclosed
Original Article Summary
A team from the University of Massachusetts Amherst has shown that a contactless credit card keeps working past its printed expiration date, even after the cardholder gets a replacement. They named it the Zombie Card attack and presented the findings at USENIX Security 2026. The question behind the loophole “This work is motivated by documented patterns of improper expired card handling. Although issuers instruct cardholders to destroy expired cards after replacement, cardholders routinely underestimate this … More → The post Researchers find a loophole that lets expired credit cards make unauthorized payments appeared first on Help Net Security.
Impact
Contactless credit cards from various issuers (specific brands not mentioned)
Exploitation Status
The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.
Timeline
Newly disclosed
Remediation
Cardholders should destroy expired cards immediately upon receiving replacements to prevent unauthorized use.
Additional Information
This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.