An expired payment card may still work

Blog author: Matúš Jaco

It may look like a piece of plastic that can no longer be used to pay for anything and can simply be thrown away. Under the right conditions, however, an expired payment card may still be capable of completing a financial transaction.

The “Zombie Card” attack demonstrated by researchers at UMass Amherst offers both a practical warning for cardholders and a valuable lesson about the security of complex systems. The expiration date is not a physical off switch for the chip. It is a piece of data that must be evaluated correctly by every component involved in the payment process. This is precisely what the researchers focused on. When a bank issues a replacement card, the underlying account may remain active, while the old and new cards may share the same primary account number (PAN) but have different expiration dates.

How the researchers tested the attack

The team first examined which data a card and terminal exchange during a contactless payment and which values are protected by a cryptographic signature. In the tested Visa configuration, the terminal evaluated the card’s validity using the Application Expiration Date field. This field was not included in the signature being verified. The card issuer, meanwhile, used an expiration date stored in a different field during authorization. The researchers therefore tested whether the two values could be made inconsistent without breaking the card’s cryptography.

In a controlled experiment, they used two ordinary NFC-enabled smartphones. One communicated with the expired card, while the other interacted with the payment terminal, with messages relayed between the two phones. During the relay, the researchers changed the expiration date read by the terminal to a future date. The card continued to generate a legitimate payment cryptogram. Its keys were not compromised and the data stored on the chip was not rewritten – only the information transmitted between the card and the terminal was modified. Similar weaknesses in wireless communication, cryptography, and protection against manipulation are assessed through IoT and embedded device penetration testing.

The researchers recorded the communication between the card and terminal and compared the results before and after the modification. They tested several payment networks and terminals, as well as cards issued by five major US banks. They then verified the behaviour using their own expired cards for which replacements had already been issued, testing them in a laboratory with commercial terminals and through small purchases from informed merchants. Every test transaction was paid in full.

Zombie Card as a lesson in system security

The security of NFC payments and contactless cards cannot be assessed through a single isolated control. In the Zombie Card attack, the card generated a valid cryptogram and the terminal processed the data it received. However, in the tested Visa configuration, the expiration date used by the terminal was not adequately protected against modification while in transit. If the issuer verified that the account was active but failed to check the status of the specific old card, each individual control could pass and the transaction could still succeed.

Who ultimately decides whether a card is still valid? The terminal may detect an expired card, but during authorization the bank must also verify the status of the specific card, not merely the account behind it. Penetration testing of payment systems and simulated attacks against transactions can reveal weaknesses at the boundaries between the card, terminal, and bank. This is why security controls must be tested together under realistic conditions and responsibility for the final decision must be clearly defined.

How to dispose of an old card safely

The safest option is to return the plastic card to its issuer for secure disposal or use a collection method recommended by the bank. If this is not possible, cut directly through the visible chip so that it breaks, then cut the card into several additional pieces. Cuts through the edges will also sever the contactless payment antenna, which is typically embedded around the perimeter of the card.

Cut through the magnetic stripe and separate the sections containing the printed card number, expiration date, and security code. Dispose of the pieces separately so that they do not remain together in the same bin. Only use a shredder specifically designed for plastic cards. Cutting off a corner, scratching out the number, or passing a magnet over the card is not equivalent to physically destroying the chip.

Continue monitoring your account after replacing the card and report any unfamiliar transaction to your bank immediately. An old card is only certain to be out of play once it has been securely destroyed. Whether the bank would reliably reject it is, following the Zombie Card findings, also a matter of trust in the payment system. The fate of the physical card, however, remains quite literally in our own hands.

Do you know whether your security controls will work during a real attack?

Penetration testing identifies weaknesses between technologies, processes, and security mechanisms before an attacker can exploit them.