Zombie Card: the expired Visa in your kitchen drawer may still pay for groceries
Researchers showed that the expiry date on some Visa contactless cards can be manipulated, so a card the bank considers dead is still accepted at a terminal. The old card you cut in half is fine. The one you tossed whole is another matter.
When a card expires, the assumption is that it dies. The date on the front passes, the bank posts you a new one, and the old piece of plastic becomes rubbish — a thing you might leave in a drawer for years, or drop in the bin without much thought.
Malwarebytes Labs has written up academic research on what it calls a Zombie Card attack: on some Visa contactless cards, the expiry date involved in the transaction can be manipulated, and the payment goes through anyway. In other words, the date is not the lock people think it is. We don't know from the published write-up how many card types are affected, which issuers, or whether Visa has shipped a fix. That gap matters, and we'd rather say so than fill it in.
The important part is not the trick itself — it's what sits behind the card. When your card expires, your account doesn't. The bank replaces the plastic; the money stays where it was. So a card that can still be used isn't a museum piece with a dead balance behind it. It's a working key to a live account.
Contactless makes it worse in a very ordinary way. Small taps go through without a PIN, in seconds, at any shop counter. Nobody at the till examines the date. The terminal decides, and the research says the terminal can be told the wrong thing.
An expired card is a key you stopped guarding because you assumed the lock had changed.
This is why the finding is interesting beyond the lab. Most card fraud advice assumes the danger is online: skimmers, phishing texts, data breaches. This one runs the other way. The risk is physical, it's in your house, and the security model everyone relies on — "it's expired, it's harmless" — is a habit, not a guarantee.
Anyone who has ever thrown an old bank card in the bin without cutting it — which is most people. Especially the 20-40 crowd who change cards constantly: a new bank because the app was better, a card that came with a food delivery deal, a travel card used for one trip, a replacement after the last one cracked. If you've had five cards in five years, you have four pieces of plastic somewhere and you probably can't say where. It also hits anyone who shares a flat, moves often, or leaves boxes with an ex, a landlord or a former housemate — the old card travels with your old stuff. And it hits parents who hand a dead card to a toddler as a toy, which is a genuinely common thing to do.
Two things to watch. First, whether Visa or any issuing bank publicly confirms the flaw and says which cards are affected — card networks usually stay quiet until the research is presented in full, so the academic conference paper is where the detail will appear. Second, whether banks change the disposal advice they print in the letter that comes with your new card. Right now most say "destroy the old one" in small type. If that language moves to the front of the envelope, they took it seriously.
Card security has spent 20 years moving from the plastic to the chip to the phone. This research points back at the plastic — the part everyone stopped thinking about. Go and find your old cards. Not because someone is coming for them, but because you'll be surprised how many there are, and how little you remember of where they've been.
Sources: Malwarebytes Labs, "Zombie Card: An expired Visa credit card can be used for purchases", August 2026, reporting on published academic research.
Written by THE TELL’s AI newsroom. how we work · corrections