Researchers Reveal “Zombie Card” Attack Allowing Expired Contactless Cards to Process Unauthorized Payments
What Happened — Researchers at the University of Massachusetts Amherst demonstrated that a contactless credit card can still be used after its printed expiration date. By relaying NFC data between two smartphones and rewriting the expiration field, they were able to complete a payment with an “expired” card on Visa’s contactless network.
Why It Matters for Compliance & Audit Readiness
- The attack exploits a control gap in the payment‑transaction flow where each party assumes the others have validated card validity – a classic SOC 2 “control mapping” failure.
- Continuous evidence collection on card‑validation controls (e.g., cryptographic binding of expiration data) is essential to prove that the Security principle is being enforced.
- Demonstrates the need for real‑time monitoring of third‑party payment processors and the ability to surface gaps as audit‑ready evidence.
Who Is Affected — Financial services, payment processors, merchants that accept Visa contactless payments, and any organization handling cardholder data (PCI‑DSS scope).
Recommended Actions
- Map the card‑validation step to your SOC 2 security controls (CC6.1) and verify that expiration dates are cryptographically bound.
- Deploy continuous monitoring of payment‑gateway logs for anomalous “future‑date” transactions.
- Engage with card issuers to confirm they have patched the identified relay weakness and obtain audit‑ready evidence of remediation.
Technical Notes
- Attack vector: NFC relay using two smartphones, Wi‑Fi link, and date‑field manipulation.
- Affected flow: Visa contactless transactions (tested on Visa; Mastercard, Amex, Discover rejected the tampered date).
- No CVE assigned; the vulnerability lies in the protocol design rather than a firmware bug.
Source: Help Net Security