That expired Visa card in your drawer can still buy groceries

Most people snip a corner off an expired card and drop it in the bin, or leave it in a drawer because throwing away a bank card feels wrong. Three researchers at the University of Massachusetts Amherst have just made a solid case for destroying it properly.

Muhammad Taqi Raza, Raja Hasnain Anwar and Gerard DeCunha presented the work, which they call the Zombie Card attack, at the USENIX Security Symposium in Baltimore from 12 to 14 August. The setup is two NFC-capable phones sitting between the card and the shop's terminal. One reads the card, the other rewrites the expiry date to something in the future, and the terminal accepts it. The reason is a gap in Visa's contactless implementation, Kernel 3: the expiration date isn't bound to the data the card cryptographically signs, so changing it breaks nothing that gets checked. In Anwar's words, almost any future date works. The same tampering was tried on Mastercard, American Express and Discover, and all three declined it.

These weren't lab-only results. The team pushed transactions through at real tills - $2.79 at a retailer, $3.19 at a grocery store - alongside amounts up to $500 in testing. It works while the account behind the card is still open under the same number, which is exactly what happens when your bank posts you a replacement. It also needs the physical card, or prolonged close contact with it. The researchers told Visa in May 2025; Visa's red team has been reproducing it, but no fix has been confirmed and no CVE was assigned. Nobody has reported this being used in the wild.

Raza's advice is blunt: always discard an expired card, and keep reading the statements on accounts you've closed. Destroy the chip and the magnetic stripe, not just the plastic around them. None of this touches your computer, which is worth saying plainly - Tendvane's Privacy and accounts check covers the accounts your PC is signed into, and a card in a kitchen drawer isn't one of them.