Researchers this month showed that some expired contactless cards could still be used in fraudulent purchases by exploiting the gap between what a point-of-sale terminal checks locally and what the issuer verifies later. As payment systems keep changing, older rails are not inherently safer because they are established.
What stands out in the zombie-card research is not just the exploit itself, but the architecture underneath it. The weakness lives in the gap between multiple actors enforcing different checks at different moments. When payment logic is fragmented across terminals, networks, and issuers, the handoffs become part of the risk. A more programmable stack will not remove risk, but it can make the rules, state changes, and failure points easier to see and easier to update.
That matters for how we think about the next phase of payment products. Cards are one interface. The more important issue is the system underneath, where balances live, how money gets funded, how settlement works, and how much friction appears before value reaches the person or business on the other side.
The researchers’ point was not just that one card check failed. It was that payment security is split across different actors. As one summary put it, “gaps between how each of them enforces security checks are exactly where this kind of exploit lives.” That fragmentation is part of the product problem. [Source]
In many markets, the problem is not whether a user knows how to tap, swipe, or spend. The problem is whether the system behind that action can move money reliably across borders without extra fees, trapped float, or long delays between authorization and final settlement.
This is where payment infrastructure is heading. Cards, wallets, local payout rails, and stablecoin settlement are starting to look less like separate categories and more like connected parts of the same system.
There will never be a perfect payment system, and new exploits will keep appearing as old assumptions get tested. The real risk is complacency. Payments are changing. If money now moves across wallets, cards, local rails, and global networks at the same time, the stack cannot stay fragmented forever. Newer payment architecture should reflect the world as it works now, not the one older rails were built for.
