AI Weekly Malaysia

Researchers from UMass Amherst demonstrated at USENIX Security 2026 that expired Visa contactless credit cards can be revived to make unauthorized payments via a man-in-the-middle attack using mobile phones as NFC proxies. The vulnerability stems from Visa's EMV kernel not cryptographically binding the expiration date, unlike American Express, Discover, and Mastercard kernels, and from wallet Card Transaction Qualifiers steering transactions toward online authorization rather than immediate rejection.

Why: If you build or integrate payment systems in Southeast Asia—where contactless card and wallet adoption is near-universal—this is a concrete protocol-level flaw in Visa's contactless kernel, not a configuration mistake. Fintech builders should verify whether their issuer-side authorization logic independently checks card expiration rather than trusting the POS terminal's evaluation, since the attack exploits exactly that delegation gap.

Researchers at UMass Amherst demonstrated a 'Zombie Card' attack that rewrites the expiration date a POS terminal reads from an expired Visa contactless card over NFC, reviving it for in-store purchases without breaking the card's cryptography. The attack requires physical possession or sustained NFC proximity plus a MitM relay, and only succeeded at one of three tested US banks; another declined all attempts and a third used a different EMV kernel where the modification failed. Disclosed to Visa in May 2025, no CVE, no exploitation, and no published mitigation exist as of August 2026.

Why: If you build or integrate contactless payment flows in Southeast Asia, this highlights that Visa's Kernel 3 does not enforce consistency between the terminal-facing Application Expiration Date (tag 5F24) and the issuer-facing Track 2 expiry (tag 57), meaning your issuer-side authorization logic must independently re-check expiry rather than trusting terminal-validated data. Builders should not assume EMV contactless specs close this gap.