Researchers at the University of Massachusetts Amherst presented findings showing that expired Visa cards can be repurposed for fraudulent contactless transactions through a proxy technique. By using a man-in-the-middle application that relays card data between two mobile devices, attackers can bypass normal transaction protections because Visa's authentication system fails to properly validate expiration status, instead delegating the responsibility to individual card-issuing banks. This inconsistency in verification protocols creates a loophole where some banks adequately reject zombie cards whilst others fail to prevent their use.

The vulnerability carries practical implications for cardholders, as discarded or lost expired cards could potentially be retrieved and exploited for unauthorised payments, especially at unattended terminals where visual inspection is absent. The ease with which an expired card might be recovered through refuse searching makes this a meaningful security risk. Security experts recommend that individuals physically destroy old cards upon expiration rather than disposing of them intact, as simple destruction can eliminate the threat posed by this authentication gap.