# An Expired Card Still Needs a Kill Switch

> Researchers revived some expired Visa contactless cards by changing the date a checkout terminal read. The practical lesson is simple: report missing cards and destroy the chip in old ones.

- **Author:** Kubilay Tunca
- **Published:** 2026-08-23
- **Category:** For Mortals
- **Tags:** Online Safety, Payment Security, Fraud Prevention, Contactless Payments
- **Canonical URL:** https://cyber-security-in-plain-english.com/post/mortals/news/expired-card-still-needs-a-kill-switch

---

An expired bank card looks finished. The replacement has arrived, the date on the old one has passed, and the old rectangle has moved from your wallet to a drawer. Perhaps it goes into the bin a few months later. Most of us treat the printed date as a small built-in kill switch.

Researchers at the University of Massachusetts Amherst have shown why that assumption can fail. At USENIX Security 2026, held from 12 to 14 August, they presented a test in which an expired Visa contactless card completed real purchases after two ordinary Android phones changed the expiry date seen by the checkout terminal. [The researchers tested cards and transaction paths involving five large US banks](https://www.usenix.org/conference/usenixsecurity26/presentation/anwar), although the full expired-card experiment covered a smaller subset and succeeded or failed according to the bank behind the card.

The result is narrower than the name “Zombie Card” suggests. Nobody can point a phone at any expired card across a room and empty the account. The test required possession of the old card, or close and sustained access to it, two relay devices, a compatible contactless Visa transaction, an account that still used the same card number, and an issuing bank that did not catch the altered date. [No criminal use of this exact technique had been reported as of 20 August 2026](https://thehackernews.com/2026/08/zombie-card-attack-can-revive-expired.html).

That narrow threat still changes one useful household habit. An expired card should be handled like an old house key whose lock may still turn. Cut through the chip, damage the magnetic stripe, and report any missing card to the issuer even when the date has passed. The printed date tells you when ordinary use should stop. It does not prove that every system behind the payment has forgotten the credential.

## What the researchers brought back to life

The team began with a sensible question. A credit-card account often continues after one physical card expires, and refunds can still find their way back to that account. Muhammad Taqi Raza, an assistant professor at UMass Amherst, wondered whether an old card could travel in the other direction and make a payment. Raja Hasnain Anwar and Gerard DeCunha joined him in testing the idea.

Their paper describes a contactless payment as a conversation among several parties. The card gives data to the checkout terminal. The terminal and merchant pass an authorisation request through the payment network. The bank that issued the card decides whether to approve it. Each participant checks part of the transaction, and speed matters because a customer expects a tap to finish in less time than it takes to put the card away.

The researchers built a relay with two Android phones. One phone sat close to the expired card and behaved like a checkout terminal. The second sat beside the real checkout and behaved like a card. They communicated over Wi-Fi, passing the payment conversation from the real card to the real terminal while one value changed in the middle.

That value was the application expiry date read by the terminal. The altered date did not need to match the replacement card. It merely needed to be in the future. The rest of the data, including the part checked by the issuing bank, continued on its normal route.

This was not a forged signature or a stolen encryption key. The affected Visa contactless design left the terminal-facing expiry value outside the digital signature that the terminal checked. A person in the middle could change that value without causing the signature to fail. [Help Net Security independently described the same two-phone relay and unsigned date field on 20 August](https://www.helpnetsecurity.com/2026/08/20/zombie-credit-card-attack-expired/).

The researchers used their own cards and accounts, their own merchant terminal, and small purchases at a grocery shop and a campus retailer. Against one anonymised bank, the revived card completed laboratory payments of $1, $100, and $500, followed by real purchases of $2.79 and $3.19. A second bank saw enough to decline the altered transactions and asked for the replacement card instead.

That split result matters. The paper does not say that all Visa cards from all banks work after expiry. It shows that the payment chain can produce different answers because the network, terminal, and issuer do not all bind the same card-lifecycle facts into one decision. One bank relied on the terminal's view and the continuing card number. Another applied an additional check and stopped the payment.

The team also tested how other contactless payment systems handled the changed date. In the configurations they examined, Mastercard, American Express, and Discover rejected the alteration. Their designs either compared the two versions of the expiry date or included the relevant data in a cryptographic check. This makes the reported weakness specific to the tested Visa route rather than a reason to distrust every tap-to-pay card.

The work was presented at a peer-reviewed security conference, and the authors published the paper plus cleaned transaction records. They withheld the relay code because it could be adapted for fraud. The researchers say they reported the findings to Visa and affected banks in May 2025, then made contact again in December. As of the paper's publication in August 2026, Visa's red team was reproducing the report, but the authors had not received details of a completed fix.

The absence of a public fix does not prove that every issuer remains exposed. Banks can add checks without publishing their internal fraud rules, and the researchers deliberately hid bank names. It does mean cardholders cannot look up a simple list, find their logo, and declare the matter settled. The proportionate response has to work regardless of which bank sits behind the card.

## Why the printed date did not stop the payment

A plastic card carries several kinds of identity. There is the long card number, usually called the primary account number. There is an expiry date printed for people and encoded for payment systems. There are secret keys inside the chip that help prove the card is genuine. Your bank also keeps a record of the account and whatever physical cards it currently considers valid.

Those pieces do not all expire together. When a bank replaces a card in the ordinary cycle, it may keep the same long card number and issue a new date. The account remains open. Certificates used by the chip can remain valid beyond the date printed on the plastic, partly to avoid breaking normal replacement and overlap periods. A genuine old chip can therefore continue proving that it was made by the issuer even after routine purchase policy says its time is up.

Think of a hotel where your room key carries both a genuine hotel stamp and a checkout date written on a separate slip. The front desk checks the stamp. The lift checks the date. If the date can be rewritten without damaging the stamp, each check can pass while the combined conclusion is wrong. Strong locks around one fact do not protect a neighbouring fact that was left outside them.

Visa contactless payments in the tested setup carried the expiry in two places. The checkout terminal used one copy to decide whether the card had expired. The bank received another copy as part of the card's track data. According to the paper, Visa's Kernel 3 did not require a consistency check that would bind those two views together.

A payment kernel is the set of rules a checkout terminal follows for one card network. The name sounds like something only an engineer should care about, but its job is familiar: read the card, check required details, decide what can be approved locally, and prepare information for the bank. Different networks use different kernels, which helps explain why the same date change failed against the other tested systems.

The affected Visa rule also left the application expiry date outside a fast digital signature checked during contactless use. The relay changed the date shown to the terminal while leaving the signed material alone. The checkout saw a future date and a valid signature because those answers came from separate pieces of the conversation.

The bank could still have caught the mismatch. One of the tested banks did. Yet the payment message did not always carry useful evidence of the terminal's local expiry check, and some issuers appeared to approve against the still-open card number without requiring the currently valid date. The responsibility had been divided so that each participant could reasonably believe another participant had settled the question.

This is a common kind of security failure. Every component may perform its assigned check correctly, but the boundary between components leaves a gap. The terminal says, “I checked the date I saw.” The bank says, “I checked the genuine card and active account.” Neither statement proves that the date and genuine card belonged together.

The researchers measured an average transaction time of about 415 milliseconds in their relay setup. EMV allows up to 500 milliseconds for each command, so the added hop did not automatically make the payment look too slow. An optional relay-resistance feature could detect suspicious delay, but the physical cards and terminals in the team's testbed did not use it.

None of this means contactless payment encryption is useless. The cryptography did its assigned job and confirmed data that had been included within its protection. The dangerous detail sat just outside that protected set. When a system says “signed,” the useful follow-up is always “which exact facts were signed?”

## The realistic threat is an old card that escapes your control

The Zombie Card test needs something many dramatic summaries leave out: access to the old card. One phone must communicate with its contactless chip. That normally means physical possession or close, sustained proximity while the payment exchange runs. The researchers did not describe a remote attack launched with only your name, card number, or email address.

A forgotten card in your kitchen drawer is therefore a very different risk from one left in a hotel bin, office wastebasket, moving box, or unlocked car. The technology matters after somebody gets the plastic. Before that point, ordinary control of the object does most of the work.

The account also needs to remain useful. Routine replacement often preserves the long card number, which is one condition that made the old card interesting in the experiment. If the issuer closes the credential fully, changes the account relationship, or checks the presented date against the current card record, the attempted payment should fail. The cardholder cannot see those internal rules from the front of the card.

The tested route also depended on Visa contactless processing and the choices made by a particular issuer. A Mastercard, American Express, or Discover setup rejected the date change in the researchers' tests. One of the banks behind a Visa card also rejected it. Treat the finding as a reason for good disposal, not as evidence that every expired card is secretly spendable.

There is another useful limit. The researchers tested a small number of cards, terminals, merchants, and banks in the United States. Their five-bank study examined broader transaction tampering, while the expired-and-replaced-card trials involved three issuers with different policies. The successful campus purchases establish that the problem could leave the laboratory. They do not measure how often a random old card would work across the whole payment system.

No public report reviewed for this article describes criminals using the exact Zombie Card date rewrite as of 23 August 2026. That is good news. Security research is most useful when it finds a seam before the seam becomes routine fraud.

This distinction should shape your effort. You do not need a contactless-blocking wallet for every trip because of this paper. Such a wallet would do nothing for an intact expired card already discarded elsewhere. You need a reliable end-of-life habit for the plastic and a fast reporting habit when any card goes missing.

A card left at home, cut through the chip and stripe, cannot take part in the demonstrated relay. A missing card reported to its issuer gives the bank a reason to close or replace the credential instead of merely waiting for the printed month to pass. Those are stronger controls because they change the card's state or remove the material the test required.

The threat grows for people whose old mail or possessions can be reached by others. Shared accommodation, hostile family situations, stalking, domestic abuse, workplace targeting, and public-facing roles can all change what “safe in a drawer” means. Someone facing a specific adversary should destroy old cards promptly and use an issuer's lost-card route for anything unaccounted for, even if the card appears expired.

For everyone else, the same advice costs almost nothing. It is a quiet maintenance task, closer to shredding a bank letter than rebuilding a home network. Small action. Clear benefit.

## Expired, replaced, frozen, and cancelled are different states

Banking apps use several words that look interchangeable from the outside. A card can expire on schedule, be replaced before expiry, be temporarily frozen, or be cancelled after loss or suspected fraud. Those states may lead to different behaviour inside the issuer's systems.

Expiry is planned. The bank expects to send another card and keep the account running. That continuity is useful because subscriptions, refunds, and account history should not vanish every few years. It also explains why an expiry date may act as a purchase rule rather than a physical self-destruct mechanism.

Replacement can happen because the old card is approaching expiry, physically damaged, or due for a new design. Some replacements keep the card number. Others change it. The paper describes one card that had been replaced automatically before its printed expiry; in one tested configuration, both the old and new card could transact during the overlap period. That separate observation did not depend on rewriting an already expired date, but it shows why “the new one arrived” should not be treated as proof that the old chip is dead.

A temporary freeze is designed to be reversible. People use it when a card may be under the sofa rather than stolen. The exact effect varies by bank, and some recurring or already-authorised transactions may still proceed. A freeze is a useful pause while you search. If the card remains missing, contact the issuer and follow its lost-card process instead of leaving the account in a temporary state forever.

Cancellation after loss or theft is a stronger event. The issuer can mark the card as compromised, issue a replacement, and watch for attempted use. [Visa tells cardholders to report a missing card and request a replacement](https://usa.visa.com/support/consumer/lost-stolen-card.html), while the US Federal Trade Commission says prompt reporting matters because legal protection can depend on the type of card and when the loss is reported.

That is why the cardholder should use the issuer's intended state change rather than guessing from the calendar. An expiry date is information printed years in advance. A lost-card report is a current instruction that says the credential is no longer under your control.

A household can make this distinction simple. If the old card is physically in your hand after normal replacement, destroy it. If you cannot account for it, report it. If you merely misplaced a current card and your bank offers a freeze, freeze it while you search, then cancel it if it stays missing.

The issuer's app is often the quickest route, but check the contact details through an app you already use, the issuer's official website, or the number on another genuine statement. A search advert or text message about “urgent card verification” may lead somewhere else. The need to act quickly does not require trusting the first telephone number on a search page.

## What to do with the old card today

The right response is a short sequence. It covers the demonstrated physical requirement, gives the issuer a chance to close a missing credential, and preserves your ability to challenge a charge. You do not need to know which contactless kernel your local shop uses.

**1. Gather the old cards you still control.** Check the wallet, spare purse, desk drawer, travel bag, filing box, and the envelope where the replacement arrived. Include cards replaced early because of damage or renewal, even if their printed date has not passed. The goal is to account for the plastic, not to test whether it can still buy something.

**2. Compare them with the current account.** Use the bank's app or statement to identify which card is active. Do not post photographs of old cards or enter their details into a third-party “zombie card checker.” No consumer test is needed, and an old card still displays information worth protecting.

**3. Destroy the chip and stripe.** Cut through the metallic chip rather than merely clipping a corner. Cut across the magnetic stripe as well, then separate the pieces. A heavy-duty card shredder that accepts plastic cards is suitable. If the card is metal, ask the issuer for its return or destruction procedure because household scissors may fail or cause injury.

**4. Report any card you cannot find.** Use the bank or credit union's official lost-card control even when the printed date has passed. Tell them the card is no longer in your possession and ask whether they need to cancel that physical credential or replace the active card. Keep the date, time, and confirmation number.

**5. Check recent and pending transactions.** Look for unfamiliar purchases, including small amounts that could be overlooked. If you see one, contact the issuer through its official fraud route. Do not contact a merchant using details supplied in a suspicious transaction message before speaking with the bank.

**6. Keep alerts on for the continuing account.** Transaction notifications can turn a hidden test purchase into an immediate question. Set a useful threshold if your bank allows one, but remember that a low-value fraudulent payment can sit below it. Reviewing the statement still matters.

The FTC's current consumer guidance draws an important distinction between credit and debit cards. [Federal limits on liability depend on the card type and how quickly the loss or unauthorised use is reported](https://consumer.ftc.gov/articles/lost-or-stolen-credit-atm-and-debit-cards). A debit-card dispute can also involve money that has already left your bank balance while the claim is investigated. Speed is practical, not merely procedural.

Visa's Zero Liability policy covers eligible unauthorised transactions on many Visa credit and debit cards, but it has conditions and exclusions. [Visa directs cardholders to notify their issuing financial institution immediately](https://www.visa.com/en-us/personal/security/zero-liability-policy). Your bank or credit union remains the party that can tell you how the policy and local law apply to your account.

Do not mail an intact card back unless the issuer gives you a verified address and asks you to do so. Ordinary disposal after cutting is enough for most plastic cards. A metal card is the common exception because many issuers provide a return envelope or branch service.

## What you can safely skip

You can skip panic about every contactless purchase already made. The research describes a way to reuse some old cards under a specific chain of conditions. It does not show that ordinary taps reveal your secret key to the shop or that a stranger can revive a card without reaching it.

You can also skip drilling into every card with power tools. The practical target is the chip and magnetic stripe. Cut them so the card cannot be presented intact or easily taped back together. For metal cards, use the issuer's route. There is no prize for turning disposal into a workshop injury.

A radio-blocking wallet does not solve the old-card problem once the old card leaves the wallet. It may reduce casual contactless communication while a card remains inside, but the published test involved sustained access to the target card and a second device at the terminal. Destruction and reporting address the credential's lifecycle more directly.

Do not ask a shop to “see if this old card still works.” A successful payment would be a real transaction, and a failed payment would tell you little about other terminals or the issuer's policy. The researchers used controlled accounts, an approved study process, and limited live purchases. Consumer curiosity does not need to reproduce the experiment.

You also do not need to replace every current Visa card. A current card is supposed to work, and the reported issue concerns how some systems handle an old one. Replacing a current card while leaving the previous card intact in the bin would reverse the useful order.

Switching off contactless payment on the current card is optional if your bank offers the setting and you do not use tap-to-pay. It can reduce one route on that active credential. It does not replace reporting a missing card, checking transactions, or destroying old plastic, and the exact effect on digital wallets or existing authorisations varies by issuer.

Nor should you assume a card is harmless because an online purchase using its old date failed. The paper concerns a contactless conversation at a physical terminal. Online checkout, chip-and-PIN, magnetic stripe, and mobile-wallet transactions follow different paths. One failed path does not certify the plastic as dead across every other path.

A broad claim that “bank cryptography is broken” also misses the lesson. The card's protected data continued to verify. The gap came from a lifecycle field that was not consistently tied to that protection and from different participants relying on one another's checks. Precise language points toward a precise repair.

## What banks and payment networks need to repair

Cardholders can control the plastic, but the durable fix belongs inside the payment system. An expiry date used to approve a transaction should be protected as part of the transaction, checked consistently, and visible to the issuer that makes the final decision. The customer should not carry the whole burden for a protocol seam.

The researchers propose binding the application expiry date and related cardholder-verification fields into a signature or authenticated transaction hash. If a relay changes the date, the cryptographic check should fail. The Mastercard, American Express, and Discover configurations in the study show several ways such consistency can be enforced.

Terminals can also compare the two versions of expiry information they receive. A mismatch should stop the transaction or produce evidence the bank can see. Quietly changing a local warning into zeros before authorisation removes the very signal that could help the issuer make a better choice.

Issuers have another strong check available. They can authorise against the combination of card number and current expiry rather than treating the card number alone as the identity that matters. If a replacement carries a new date, the old combination should no longer buy things even while refunds and other legitimate account paths remain available.

The trade is operational complexity. Payment networks serve old terminals, many bank systems, international routes, unreliable connections, and customers who expect a tap to work immediately. A strict change can create false declines if records are out of sync. That cost deserves engineering and testing; it does not justify leaving ownership of the check ambiguous.

Relay resistance can add another layer by measuring how long card responses take. The researchers' two-phone path added delay but stayed within the tested timing limits, and the optional resistance feature was absent from their physical testbed. Timing alone will never carry the whole defence because networks and phones introduce ordinary delay. It can still make relay fraud harder when combined with protected data and issuer checks.

Public communication would help too. As of 20 August 2026, The Hacker News reported no public mitigation bulletin from Visa, EMVCo, the named rival networks, or the terminal vendor used in the test. Banks may make quiet changes for good anti-fraud reasons, yet customers and merchants also benefit from knowing whether old-card handling guidance has changed.

The paper's strongest lesson is about responsibility. A terminal, network, and bank can each make a locally reasonable decision while the total transaction remains wrong. Somebody has to own the end-to-end claim: this exact physical credential, with this exact lifecycle state, is allowed to spend from this account now.

Until that ownership is clear everywhere, destruction is the cardholder's backstop. It is not a satisfying substitute for a protocol repair, but it removes the genuine chip and card data that the demonstration needed.

## Give every credential an ending

Most security advice focuses on beginnings. Choose a good password. Set up the new phone. Activate the replacement card. The quiet failures often happen at the other end, when an old credential is assumed to have died because something newer exists.

Old building passes stay in desk drawers. Former staff keep app sessions. Replaced phones remain signed in. Expired domains still receive traffic meant for the previous owner. The printed date on a bank card belongs to the same family of assumptions: a visible ending that may not have reached every system behind it.

A proper ending has three parts. The system records that the credential should no longer act. The physical or digital copy loses its ability to prove identity. The owner watches long enough to catch anything that survived the change. For an expired card, those parts are issuer state, a destroyed chip, and a review of transactions.

This does not require suspicion of every bank or every checkout. Contactless payment remains a fast and generally well-defended way to pay. The August 2026 research found a specific seam, showed that at least one tested issuer could stop it, and gave the industry several concrete repairs. That is what useful security research should do.

Your part takes less than five minutes. Find the old card, cut through the chip and stripe, and report it if you cannot account for it. Then keep the alert on the account that continues behind the plastic.

The date on the front can retire a card from ordinary use. A clean ending makes sure the rest of the system gets the message.

For more calm, practical security guidance, the newsletter sends one email per month. The signup lives on this site.

## Sources

- [USENIX Security 2026: Zombie Cards Back Online, Reviving Expired Credit Cards for Contactless Payments](https://www.usenix.org/conference/usenixsecurity26/presentation/anwar), accessed 2026-08-23
- [USENIX Security 2026: Zombie Cards research paper](https://www.usenix.org/system/files/usenixsecurity26-anwar.pdf), accessed 2026-08-23
- [University of Massachusetts Amherst: When Zombie Credit Cards Attack](https://www.umass.edu/news/article/when-zombie-credit-cards-attack-umass-researchers-discover-loophole-can-reanimate), accessed 2026-08-23
- [The Hacker News: Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments](https://thehackernews.com/2026/08/zombie-card-attack-can-revive-expired.html), accessed 2026-08-23
- [Help Net Security: Researchers find a loophole that lets expired credit cards make unauthorised payments](https://www.helpnetsecurity.com/2026/08/20/zombie-credit-card-attack-expired/), accessed 2026-08-23
- [US Federal Trade Commission: Lost or Stolen Credit, ATM, and Debit Cards](https://consumer.ftc.gov/articles/lost-or-stolen-credit-atm-and-debit-cards), accessed 2026-08-23
- [Visa: Reporting Stolen and Lost Credit Cards](https://usa.visa.com/support/consumer/lost-stolen-card.html), accessed 2026-08-23
- [Visa: Zero Liability Policy](https://www.visa.com/en-us/personal/security/zero-liability-policy), accessed 2026-08-23

---

## About the author

Kubilay Tunca — Senior Full Stack Developer and Author. Founded Cyber Security in Plain English to translate complex security concepts into clear, practical advice, and writes the accompanying books on security, privacy, secure development, and AI systems.

## Books by this author

- **The Digital Fortress** — Your Everyday Guide to a Safer Digital Life. A warm, plain-English guide for people with real lives and finite patience. Learn the handful of habits that genuinely protect your money, accounts, and family, and get honest permission to ignore the rest. [Amazon](https://buy.cyber-security-in-plain-english.com/digital-fortress) · [Details](https://cyber-security-in-plain-english.com/books/the-digital-fortress)
- **The Anonymity Playbook** — Digital Survival for Whistleblowers, Journalists, Activists, and Everyone Else. A practitioner’s field manual for journalists protecting sources, whistleblowers, and activists. It explains how the surveillance actually works, what each technique costs you, and exactly where it fails. [Amazon](https://buy.cyber-security-in-plain-english.com/anonymity-playbook) · [Details](https://cyber-security-in-plain-english.com/books/the-anonymity-playbook)
- **Secure Software Development** — Practical patterns for building secure software. A hands-on security guide for developers and IT professionals who ship real software. Build, deploy, and maintain secure systems without slowing down or drowning in theory. [Amazon](https://buy.cyber-security-in-plain-english.com/secure-software-development) · [Details](https://cyber-security-in-plain-english.com/books/secure-software-development)
- **The Secure Harness** — Shipping Production Code with AI Coding Agents. A calm, practical guide to letting agents do useful work inside boundaries you set, enforce, and audit. Ships with 15 copy-pasteable artifacts: hook scripts, permission configs, release gates, and MCP templates. [Amazon](https://buy.cyber-security-in-plain-english.com/secure-harness) · [Details](https://cyber-security-in-plain-english.com/books/the-secure-harness)
- **The AI Native Engineer** — Build, Evaluate, and Ship AI Systems That Work in Production. Sixteen hands-on chapters, one real product. Grow it from a single model call into a retrieved, tool-using, observable, production-grade system, with evaluation treated as a habit from the first feature. [Amazon](https://buy.cyber-security-in-plain-english.com/ai-native-engineer) · [Details](https://cyber-security-in-plain-english.com/books/the-ai-native-engineer)

Full catalogue with contents and intended audience: https://cyber-security-in-plain-english.com/books

_As an Amazon Associate I earn from qualifying purchases. Buying through these links costs you nothing extra and helps pay for the blog._