The Dead Have Risen, And They Want To Buy Groceries
I have been saying for thirty years that contactless payment technology was a catastrophic mistake. Thirty years. I said it at the 1996 symposium in Cincinnati. I said it to my department head. I said it to a man on a bus in 2003. Nobody listened.
Now researchers at UMass Amherst have demonstrated what they are calling the "Zombie Card" attack, and I am not even slightly surprised. The short version: an expired Visa contactless card is not actually dead. A wolf with the right equipment can intercept the NFC handshake between your card and the point-of-sale terminal and rewrite the expiration date the terminal reads. The card's cryptography remains completely intact. The terminal sees nothing wrong. Your deceased Visa card gets up, straightens its tie, and buys a rotisserie chicken.
No cryptographic break required. Just a quiet little lie whispered over radio frequencies, like a ghost haunting a checkout line.
You know what didn't have this problem? Cash. Magnetic stripe. A physical card that required a physical signature from a physical human being who could be held physically accountable. In the old days, the flock had to hand their card to a clerk who ran it through a knuckle-buster. You remember knuckle-busters? Carbon paper? Accountability?
Now we have cards that broadcast their credentials to anything within four centimeters, and we are shocked, SHOCKED, when a wolf decides to listen in.
The Shepherds in the C-suite, naturally, will read this report, nod gravely, schedule a meeting, and then approve a budget for a new brand of artisanal hand sanitizer for the lobby. The flock, meanwhile, will continue tapping their expired cards on everything including, I suspect, vending machines and strangers' foreheads.
The Sky Pasture ecosystem enabling these frictionless payments has made everyone comfortable and lazy. Comfort is the enemy of security. I wrote that in 1991. It is still true.
Remediation
Here is what you actually do, since apparently this requires explanation:
Destroy expired cards immediately. Cut them. Shred them. Burn them if you are feeling dramatic. An expired card that still physically exists is a hole in the fence waiting to be found.
Disable contactless on your active cards if your bank permits it. Most do. Most lambs do not bother asking.
Monitor your statements. Yes, manually. With your eyes. Like an adult.
Pressure your financial institution to implement terminal-side expiration validation that cannot be overridden by a whispered NFC lie. This is a Visa infrastructure problem and the Shepherds need to hear about it repeatedly and at volume.
The patch here is not software. It is policy, and it is pressure.
Stay skeptical, the wolves certainly are.
Original Report: https://thehackernews.com/2026/08/zombie-card-attack-can-revive-expired.html