Zombie Card Attack Exposes Critical Flaw in Visa Contactless Payment Security
Researchers at the University of Massachusetts Amherst demonstrated a critical vulnerability in Visa contactless payment systems that allows attackers to revive expired credit cards for fraudulent transactions. The 'Zombie Card' attack exploits a cryptographic binding weakness in Visa's Kernel 3 EMV implementation, enabling attackers with physical access to expired cards and NFC relay equipment to modify expiration dates without breaking card cryptography. Testing across five major US banks showed one bank approved fraudulent transactions up to $500, while others either declined or failed the modification. The attack requires the original account to remain open and relies on issuers not independently verifying expiration dates during authorization, exposing fundamental flaws in contactless payment security architecture. This vulnerability highlights the growing sophistication of payment card fraud techniques as contactless transactions become mainstream, with researchers identifying similar NFC relay malware like WindRelay actively targeting victims across Europe, demonstrating that theoretical academic research quickly translates into real-world criminal exploitation.
Kill Chain
