Full Report
Gaps in expiry checks could let dead plastic make purchases again
Analysis Summary
# Vulnerability: Zombie Cards (EMV Contactless Expiry Bypass)
## CVE Details
- **CVE ID:** Not yet assigned (Research published at USENIX Security 2026)
- **CVSS Score:** Estimated 6.8 (Medium/High)
- **CWE:** CWE-345: Insufficient Verification of Data Authenticity / CWE-319: Cleartext Transmission of Sensitive Information
## Affected Systems
- **Products:** Visa Contactless Payment Cards and EMV Kernels.
- **Versions:** Visa-specific implementation of the EMV contactless protocol.
- **Configurations:**
- Transactions using the Visa kernel where the Application Expiration Date is not cryptographically bound.
- Terminals and Issuers that rely on unauthenticated processing restrictions during online authorization.
## Vulnerability Description
The flaw stems from a lack of integrity protection in the EMV contactless protocol as implemented by Visa. During a transaction, the card provides an "Application Expiration Date" to the Point-of-Sale (POS) terminal. In the Visa configuration, this specific data field is sent in plaintext and is **not covered by the card's digital signature**.
This creates a synchronization gap: the terminal checks the (tamperable) date provided by the card, while the card issuer relies on a different data field for authorization. Because these dates are not cryptographically bound to each other, an attacker can modify the expiration date in transit, tricking the terminal into believing an expired card is still valid and pushing the transaction to the issuer for online authorization.
## Exploitation
- **Status:** PoC available (Demonstrated by UMass Amherst researchers).
- **Complexity:** Medium (Requires knowledge of EMV protocol and NFC proxying).
- **Attack Vector:** Proximity/Physical (Requires a Man-in-the-Middle position between the card and the terminal using NFC proxy devices/mobile phones).
## Impact
- **Confidentiality:** Low (Focus is on transaction manipulation, not data theft).
- **Integrity:** High (Allows unauthorized transactions by bypassing expiration checks).
- **Availability:** Low (Does not disrupt the payment network itself).
## Remediation
### Patches
- **Vendor Action Required:** No specific software patch for consumers. Visa and card-issuing banks must update their EMV kernels and authorization logic to ensure the expiration date is cryptographically bound and verified during the Online Data Authentication (ODA) process.
- **Status:** As of the report, neither Visa nor the affected banks have confirmed a mitigation.
### Workarounds
- **Merchant Side:** Ensure POS terminals are updated to the latest EMV standards that enforce stricter processing restrictions.
- **Consumer Side:** Shred and physically destroy expired contactless cards immediately to prevent "dumpster diving" and subsequent reuse.
## Detection
- **Indicators of Compromise:** Discrepancies in transaction logs where the expiration date provided at the POS does not match the record held by the issuing bank.
- **Detection Methods:** Card issuers can implement server-side checks to compare the expiration date used in the transaction cryptogram against the account's actual expiry date, rejecting any mismatches.
## References
- **USENIX Security 2026:** hxxps[://]www[.]usenix[.]org/conference/usenixsecurity26/presentation/anwar
- **Researcher Summary:** hxxps[://]khwarizmilab[.]github[.]io/emvexpiredcards/
- **NFC Transaction Standards:** hxxps[://]www[.]eftlab[.]com/post/the-use-of-ctqs-and-ttqs-in-nfc-transactions