ZombieLoad Flaw Exploits Intel CPUs, Exposes Sensitive Data

Key Takeaways

• Security researchers have uncovered a “Zombie Card” NFC relay attack that reactivates expired Visa contactless cards for real purchases.
• The vulnerability stems from how EMV Kernel 3 (Visa) processes expiration dates, allowing attackers to manipulate this data without invalidating the transaction’s cryptographic signature.
• The attack bypasses terminal-side expiry checks and can force transactions online, potentially leading to unauthorized purchases even with physically expired or replaced cards.
• The issue affects Visa cards and has been demonstrated against multiple major US banks.
• No confirmed fixes have been deployed yet by Visa or affected banks.

Expired Visa Cards Resurrected for Purchases in “Zombie Card” Attack

New research has exposed a critical flaw in the EMV contactless payment system, demonstrating how expired Visa cards can be resurrected to complete fraudulent transactions. Dubbed “Zombie Card,” this NFC relay attack exploits a weakness in how Visa’s EMV Kernel 3 handles expiration dates, enabling attackers to bypass terminal-side validation and process payments using cards that should no longer be active.

The findings, presented at the 35th USENIX Security Symposium by researchers from the University of Massachusetts Amherst, challenge the common belief that an expired credit card is rendered useless. Their study reveals that the expiration date in EMV contactless payments is primarily a policy check performed by the point-of-sale (POS) terminal, rather than an intrinsic cryptographic element of the card itself.

The Mechanics of Expiration and Its Bypass

At the heart of the “Zombie Card” vulnerability is the distinction between a card’s cryptographic integrity and its operational lifespan. While the private keys embedded in a chip card never expire, and authentication certificates often remain valid beyond the printed date to facilitate card reissuance, the actual expiration check relies on a single, plaintext data field: the Application Expiration Date. This field is read and validated locally by the POS terminal.

Researchers Raja Hasnain Anwar, Gerard DeCunha, and Muhammad Taqi Raza engineered a man-in-the-middle relay system using two NFC-capable Android smartphones. One phone emulated the card near the POS terminal, while the other emulated the terminal near the physical expired card. These devices communicated over Wi-Fi, allowing the researchers to intercept and modify Application Protocol Data Unit (APDU) exchanges in real time during the transaction’s data-retrieval phase.

Visa’s Kernel 3: The Critical Vulnerability Point

The team tested their relay attack across various EMV kernels: Kernel 2 (Mastercard), Kernel 4 (American Express), Kernel 6 (Discover), and Kernel 3 (Visa). Kernels 2, 4, and 6 proved resilient, detecting tampering because their expiry-related data is cryptographically bound to signed records or hashed transaction data. Any attempt to alter this information in transit resulted in a failed signature verification and a rejected transaction.

However, EMV Kernel 3, used by Visa, was a significant outlier. Its expiration field is notably excluded from the signed dynamic application data. This design flaw allows an attacker to modify a past expiration date to a future one without invalidating the transaction’s cryptographic signature. Consequently, the manipulated date bypasses the terminal’s local check undetected.

Compounding the problem, Kernel 3 transmits an all-zero Terminal Verification Results (TVR) field to the issuer. This means that banks are never informed that the terminal’s local validation process was compromised. When combined with card-side flags that can force a transaction “online” even after expiry checks fail, this creates a clear path for an expired card with a still-valid Primary Account Number (PAN) to reach the issuer’s authorization system without proper scrutiny.

Real-World Validation and Impact

The researchers successfully validated their attack, first in a lab environment using SumUp terminals, and then in real-world scenarios at various retail and grocery merchants. They conducted tests across five major US banks, using their own expired and replaced cards to prevent harm to third parties.

The outcomes varied by issuer. One bank approved “zombie” transactions up to $500, indicating that its authorization system primarily validated the account and cryptogram rather than the specific card instance or its expiry status. Another bank consistently declined these transactions and prompted the use of a replacement card. Notably, even a non-expired card that had been replaced by its issuer continued to process successful payments on the same account through this method.

Proposed Countermeasures and Disclosure

To mitigate this vulnerability, the research team has proposed a multi-layered approach involving changes across the payment ecosystem. These include cryptographically binding expiry data to signed records, enforcing consistency checks between the terminal’s expiry field and the value transmitted to issuers, treating expiration and card replacement as explicit issuer-side authorization predicates, and ensuring that genuine validation results are preserved instead of being zeroed out.

They disclosed the findings to Visa and the affected banks in May 2025. As of the paper’s acceptance, Visa’s internal red team was still working to reproduce the attack, and no confirmed fixes have been deployed. Until systemic changes are implemented, consumers remain exposed to this risk.

What You Should Do

• Physically Destroy Expired Cards: Always cut through the chip and magnetic stripe of expired or replaced cards before discarding them. Do not simply throw them away intact.
• Monitor Bank Statements: Regularly review your bank and credit card statements for any unauthorized transactions, especially after a card has expired or been replaced.
• Report Suspicious Activity: Immediately report any unusual charges or suspected fraudulent activity to your financial institution.
• Be Aware of Contactless Payment Risks: While convenient, contactless payments carry inherent risks that consumers should be aware of, including potential relay attacks.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.