BALTIMORE — That expired credit card sitting in your wallet or a kitchen drawer may not be as useless as you think.
Researchers at the University of Massachusetts Amherst found a security vulnerability that can allow some expired credit cards to be used again for contactless purchases, a technique they call a “Zombie Card” attack.
The research was presented at the 35th USENIX Security Symposium in Baltimore in August.
The researchers found that an expired card can still retain the cryptographic capability needed to communicate with a payment terminal. By using a relay system and modifying the expiration date the terminal reads, they were able to make an expired card appear valid and complete transactions.
“Just changing the expired date into a future date, the card can be brought back to life,” assistant professor Taqi Raza told WMAR-2 News.
The setup did not require specialized equipment. Researchers used two ordinary NFC-capable smartphones running custom software, one communicating with the physical card and the other with the payment terminal. The phones relayed information between the two while altering the expiration information sent to the terminal.
In one demonstration, a payment terminal initially rejected a card that had expired in August 2024. With the researchers’ system in place, the card was able to process a $100 transaction.
The team tested cards and payment systems involving Visa, Mastercard, American Express and Discover cards from five major U.S. banks. The researchers found the “zombie card” attack succeeded with some Visa cards they tested. The same expiration-date manipulation did not succeed in their testing of Mastercard, American Express and Discover payment systems.
The researchers stress that the attack requires access to the physical expired card. That means the findings are especially relevant for consumers who keep old cards in drawers or throw them away without destroying them.
Credit-card issuers already generally advise customers to destroy expired cards after receiving replacements, but researchers say consumers may underestimate the risk because they assume an expired card can no longer be used.
“Whenever the card is expired, make sure you destroy it carefully,” Raza said. He also recommends monitoring account activity and turning on transaction alerts.
Consumers should destroy the chip and magnetic stripe and cut the card so the account information cannot easily be read or reconstructed. For metal cards, consumers should check with their issuer about returning the card for secure destruction.
The researchers disclosed their findings to Visa and affected banks in May 2025 and followed up again in December 2025. According to the published study, Visa’s report had passed initial review and was undergoing testing by the company’s security team, but at the time the paper was accepted, researchers said they had not received information about what mitigations had been put in place.
WMAR-2 News reached out to Visa, Mastercard and American Express for comment on the findings. This article will be updated with their responses.
The researchers have not publicly released the software used to conduct the attack, saying doing so could make it easier for criminals to replicate before protections are widely implemented.
The takeaway for consumers is that an expired card should not automatically be treated as worthless. Destroy it before throwing it away and continue monitoring the account associated with it for unauthorized charges.
This story was reported on-air by a journalist and has been converted to this platform with the assistance of AI. Our editorial team verifies all reporting on all platforms for fairness and accuracy.