Zombie Credit Cards and the Expired Card Loophole

You probably assume an expired credit card is dead. The date printed on the plastic has passed, a replacement card has arrived, and the old card seems useful only for the trash.

That assumption may not always be safe.

Researchers from the University of Massachusetts Amherst discovered a payment-system loophole that can allow certain expired contactless cards to be accepted for unauthorized purchases. They called the technique the “Zombie Card” attack because a card that should be retired may appear to come back to life.

The research involved controlled testing with cards from five major U.S. banks, commercial payment terminals, and multiple payment configurations. The results varied. Some configurations rejected the tampered transactions, while others accepted them.

The practical lesson is not to panic. It is to stop treating expired cards as automatically harmless.

What Is the Zombie Credit Card Loophole?

An expired card and the underlying credit card account are related, but they are not always handled identically by every part of the payment system.

A contactless transaction involves several players:

• The physical card
• The checkout terminal
• The merchant’s payment processor
• The payment network
• The card issuer

Each part performs different checks. The terminal may look at the expiration date presented during the contactless transaction. The issuer may evaluate whether the underlying account is open and whether the transaction has a valid security response.

The UMass Amherst researchers found that, in certain contactless payment setups, those checks did not consistently confirm the same thing: whether that specific physical card had expired.

In their controlled demonstration, a relay placed between the card and the payment terminal altered the expiration information shown to the terminal. The card’s other security information could still appear genuine. If the issuer then approved the underlying account, an unauthorized contactless purchase could go through.

This was not a demonstration that the card’s core cryptography had been broken. It was a coordination problem. Different parts of the transaction were working with different versions of the card’s status.

How the Scam Technique Works

You do not need to understand the technical details to protect yourself, but a plain-English overview is useful.

1. The attacker obtains an expired contactless card

The attack begins with physical access to an expired card. That could happen if someone finds an intact card in the trash, steals a wallet, or takes a card that was lost after a replacement arrived.

The research does not describe a completely remote attack against every cardholder. The attacker needs the card or close-range access to its contactless signal.

2. A relay sits between the card and terminal

The researchers used two ordinary smartphones and relay software in a controlled setup. One device communicates with the card. The other communicates with the checkout terminal.

This creates a bridge between the expired card and the point-of-sale system.

3. Transaction data is altered

During the contactless EMV transaction, the relay changes the expiration information before it reaches the terminal. In the vulnerable configuration tested by the researchers, that information was not protected strongly enough against this type of in-transit modification.

The altered expiration date can make the terminal believe the card is current.

4. The issuer may receive an incomplete warning

The issuer may receive a valid-looking security response and see that the account itself remains open. If it does not independently verify the status of the specific card instance, it may approve the transaction.

That gap between what the card says, what the terminal accepts, and what the issuer verifies is the heart of the loophole.

5. The result depends on the payment system

The UMass Amherst team tested several payment configurations. Some rejected the changed expiration data. Others were more permissive. Bank controls also varied.

That means the research does not prove that every expired card can be revived. It does show that expiration protections are not enforced uniformly across the entire payment chain.

Why This Matters to Your Money

Most people focus on active cards when checking for fraud. An expired card often disappears into a junk drawer or garbage bin, while the related account remains open.

That creates three practical concerns:

• A lost or stolen expired card may still deserve attention.
• Small contactless charges can be easy to overlook.
• A replacement card does not necessarily mean the old account relationship has disappeared.

Fraudsters sometimes test stolen payment credentials with small purchases before attempting larger transactions. An unfamiliar charge for a modest amount is still worth investigating.

The research also raises broader questions for the financial industry. It is not yet clear how often this technique has been used outside controlled testing, how quickly issuers and payment networks will address the issue, or whether regulators will require changes.

For consumers, the sensible approach is layered protection. Do not rely on the expiration date alone.

Warning Signs of a Zombie Card Problem

Review your statements and transaction alerts for:

• Activity on a card that has already expired
• Unexpected contactless purchases
• Small charges you do not recognize
• Transactions appearing after you received a replacement card
• Purchases from unfamiliar merchants
• Repeated authorization attempts or declined transactions
• Charges on an account you believed was closed or inactive

Do not dismiss a small charge as insignificant. Fraud often begins with a test transaction.

Prevention Checklist

Use this routine whenever a credit card expires or is replaced:

• Monitor the account after expiration. Continue reviewing statements and online activity until you confirm the old card is no longer active.
• Destroy the physical card securely. Cut through the account number, security code, magnetic stripe, and chip. If the card has contactless capability, damage the chip and antenna area as well.
• Do not carry expired cards. Remove them from your wallet, purse, car, and travel bags.
• Avoid tossing an intact card into the trash. Place destroyed pieces in separate bags when practical.
• Report loss or theft immediately. Contact the issuer through the official phone number or mobile app.
• Turn on transaction alerts. Choose alerts for every purchase or at least for contactless transactions, if that option is available.
• Lock unused cards. Use an issuer’s card-lock or freeze feature when available.
• Close accounts you no longer need. Before closing an account, review recurring payments and confirm the issuer’s process.
• Keep records. Save replacement notices, fraud reports, dispute letters, and confirmation numbers.

What to Do If You Spot Unauthorized Activity

Act promptly. The order matters.

1. Contact the card issuer immediately. Use the number on your current card, statement, or official app. Explain that the charge is unauthorized and that the transaction may involve an expired or replaced card.
2. Ask for the card to be blocked and replaced. If the account itself is compromised, ask whether a new account number is appropriate.
3. Dispute the charge. Follow the issuer’s instructions and send a written dispute to the billing-inquiries address, not necessarily the payment address.
4. Keep paying undisputed amounts. If you dispute one charge, continue handling the rest of the bill according to the issuer’s instructions.
5. Review related accounts. Check other cards, bank accounts, email accounts, and credit reports for unfamiliar activity.
6. Consider an identity theft report. If you see broader signs of misuse, use IdentityTheft.gov for a recovery plan.
7. Report the scam or fraud. You can file a report through the Federal Trade Commission’s ReportFraud.gov website.
8. Escalate unresolved problems. If the issuer does not properly handle your dispute, submit a complaint to the Consumer Financial Protection Bureau.

The Federal Trade Commission says federal law generally limits liability for unauthorized credit card charges, but timing matters. For billing errors, written disputes generally need to reach the issuer within 60 days after the statement showing the error was sent. Keep copies of everything you submit.

The Bottom Line

The expired-card loophole is a reminder that financial security depends on more than the date printed on a piece of plastic.

The UMass Amherst research found a gap in how some contactless payment systems handle expiration information. The risk appears limited by the need for physical access or close-range contact, and results differed across payment configurations and issuers. Still, an intact expired card should not be treated as worthless.

Destroy old cards, activate transaction alerts, review statements, and report unfamiliar charges quickly. These habits protect your cash flow, reduce the chance of prolonged fraud, and make it easier to resolve a problem if one occurs.

Suggested Internal Links

• 5 Credit Card Debt Traps to Avoid
• How to Choose the Best Credit Card for You
• Find Your Perfect Match: Choosing the Best Credit Card
• Exploring the Benefits of Different Credit Cards

Frequently Asked Questions

Can an expired credit card really still work?

In certain contactless payment configurations, researchers demonstrated that an expired card could be presented to a terminal as if it were current. The finding does not apply automatically to every card, issuer, or payment network.

Does this affect every contactless card?

No. The UMass Amherst testing found different results across payment configurations and issuers. Some rejected altered expiration information, while others accepted transactions under certain conditions.

Is this a remote attack?

The demonstrated technique required physical access to the expired card or close-range access to its contactless signal. It was not described as a remote attack against every expired card.

Does replacing a card automatically close the old card?

Not necessarily. Replacement procedures vary. The old card may be blocked, but consumers should confirm with the issuer and continue monitoring the related account.

Should I stop using contactless payments?

There is no need to stop using contactless payments based solely on this research. Securely dispose of expired cards, enable alerts, and report suspicious activity promptly.

Should I put an expired card through a paper shredder?

Follow the issuer’s disposal guidance. If you cut the card, damage the chip, magnetic stripe, account number, and security code. Do not leave an intact contactless card in the trash.

What if I see a $1 or other small charge on an expired card?

Contact the issuer immediately and ask whether the charge is authorized. Small transactions can be testing activity, but only the issuer can investigate the account.

Can an unauthorized charge hurt my credit score?

A promptly disputed fraudulent charge should not automatically damage your credit. Keep paying undisputed balances and follow the issuer’s dispute process so the account is not mistakenly reported as delinquent.

Should I freeze my credit reports?

A credit freeze can help prevent someone from opening new accounts in your name. It does not stop transactions on an existing card. For an existing-card problem, contact the issuer first.

Can I report the problem to the FTC?

Yes. You can report fraud through ReportFraud.gov. If the issue appears connected to broader identity theft, use IdentityTheft.gov for recovery guidance.

Sources

• Source institution: University of Massachusetts Amherst research summary, “Zombie Cards Back Online”
• USENIX Security presentation by University of Massachusetts Amherst researchers
• The Hacker News coverage of the expired-card research
• Federal Trade Commission: Lost or Stolen Credit, ATM, and Debit Cards
• Federal Trade Commission: Using Credit Cards and Disputing Charges

Important: This article is an educational consumer resource. It does not suggest that every expired card is vulnerable or that this technique is being used widely. The safest response is simple: destroy expired cards securely and continue monitoring the related account.