Patent Description:
<CIT> discusses a card reading device and so-equipped self-service terminal and method for monitoring the same. <CIT> discusses a credit card device capable of generating a programmed magnetic field of alternating polarity based on a speed of a card swipe, and methods for constructing the device for the purpose of emulating a standard credit card. <CIT> discusses a powered card that includes a plurality of types of sensors used to detect a read-head of a card reader.

Embodiments detect a skimmer via a vibration sensor on a smart card. In one embodiment, a method is disclosed that includes receiving, at a server, from a user equipment (UE), vibration information recorded by a transaction card in response to an execution of a transaction at a point-of-service (POS) terminal of a plurality of POS terminals using the transaction card. The vibration information is received from the transaction card via a communication link between the transaction card and the UE. Further, a vibration sensor on the transaction card records the vibration information while the transaction card is swiped through the POS terminal or inserted into or removed from the POS terminal. The method includes determining, at the server, a state of the POS terminal based on the vibration information. The method further includes sending to one or more stakeholders of the transaction a warning message in response to the determination of the state of the POS terminal as being compromised. The warning message includes the state of the POS terminal and POS terminal information. In some embodiments, the vibration sensor may be a microphone or an accelerometer of the transaction card.

System and user equipment embodiments are also disclosed.

Various embodiments of this disclosure will be discussed with respect to the corresponding figures.

<FIG> illustrates an example environment <NUM>, in accordance with some embodiments, in which various embodiments described in this disclosure may be practiced. In <FIG>, a point-of-sell (POS) terminal <NUM>, a user equipment (UE) <NUM>, and an application server <NUM> are shown. The UE <NUM>, the POS terminal <NUM>, and/or the application server <NUM> may be communicatively coupled to each other via a communications network <NUM>. Even though only single instances of the application server <NUM>, the POS terminal <NUM>, and the UE <NUM> are shown in <FIG>, there may be more than one instance of each communicatively coupled to each other via the communications network <NUM>. Further, the application server <NUM> may also include a database. A transaction card <NUM> may be used to complete a transaction at the POS terminal <NUM>.

In some embodiments, by way of non-limiting example, the POS terminal <NUM> may be an automated teller machine (ATM) terminal, or a security access terminal, etc. that enables a user to perform a transaction at the POS terminal <NUM> using the transaction card <NUM>. The transaction may include, for example and without limitation, a purchase, a return, a cash withdrawal, a deposit, and/or a transfer of funds, etc..

In some embodiments, by way of non-limiting example, the transaction card <NUM> may be a bank-issued credit or debit card, a gift card, an automated teller machine (ATM) card, a rewards card, a client loyalty card, etc. The transaction card <NUM> may include a magnetic stripe and/or an integrated circuit (IC) chip that may include a transaction card number, an expiration date of the transaction card, and/or full name of the transaction cardholder.

<FIG> is a diagram of example components of a transaction card, such as the transaction card <NUM>, in accordance with some embodiments. As shown in diagram <NUM>, the transaction card <NUM> may include components, for example, a bus <NUM>, a processor <NUM>, a memory <NUM>, a storage component <NUM>, an input component <NUM>, an output component <NUM>, and a communication interface <NUM>. The transaction <NUM> may also include a battery providing power to various components of the transaction card. The transaction card <NUM> may also include an RF antenna coupled with the communication interface <NUM>. The RF antenna may be used to establish a wireless communication link with the UE <NUM>.

In accordance with some embodiments, the bus <NUM> may facilitate communication among the processor <NUM>, the memory <NUM>, the storage component <NUM>, the input component <NUM>, the output component <NUM>, and the communication interface <NUM>. The processor <NUM> may be a central processing unit (CPU), a microprocessor, a microcontroller, an integrated circuit (IC), a digital signal processor (DSP), a field-programmable gate array (FPGA), or an application-specific integrated circuit (ASIC), etc. The memory <NUM> may include a random access memory (RAM), a read-only memory (ROM), and/or another type of dynamic or static storage device, such as a flash memory, a magnetic memory, and/or an optical memory, etc. The memory <NUM> may store instructions to be performed by the processor <NUM>. Configuration related data and other data may also be stored on the memory <NUM>. The storage component <NUM> may also be used for storage of the data in addition to the memory <NUM>. The input components <NUM> may include a touchscreen display, a microphone, a button, a switch, a keyboard, a keypad, a mouse, etc. The input components <NUM> may also include various sensors, such as a GPS sensor, an accelerometer, a gyroscope, and/or an actuator, etc. The output components <NUM> may include a display screen, a speaker, and/or a light-emitting diode (LED), etc. The communication interface <NUM> may be, for example, a radio frequency (RF) transceiver that may be used to establish the wireless communication link with the UE <NUM> using Bluetooth, Wi-Fi, and/or NFC, etc..

Returning to <FIG>, accordingly, in some embodiments, the transaction card <NUM> may communicate with the UE <NUM> using the RF antenna over a communication link. The communication link may be established using an RF communication protocol. By way of non-limiting example, the RF communication protocol may be Bluetooth, Wi-Fi, or Near Field Communication (NFC), etc. The transaction card may also include a memory and a processor. The memory and the processor may be integrated into the IC chip. The memory may store instructions to be executed by the processor and other data.

In some embodiments, the UE <NUM> may be a personal computer, a laptop, a desktop, a tablet, a phone, a smartphone, a smartwatch, etc. The transaction card <NUM> may establish the communication with the UE <NUM> to communicate to the application server <NUM> via the communications network <NUM>. The communications network <NUM> may provide secure communication between the UE <NUM> and the application server <NUM> via IPsec and/or other tunneling protocols. The communications network <NUM> may be a wireline and/or wireless network, that may support communication over <NUM>, <NUM>, <NUM>, <NUM>, Wi-Fi, a Local Area Network (LAN), a metropolitan area network (MAN), a wide area network (WAN), Wi-Max, a public land mobile network (PLMN), and/or a public switching telephone network (PSTN), etc. By way of non-limiting example, the UE <NUM> may communicate with the application server <NUM> via a secure hypertext transfer protocol (HTTPS) message, a hypertext transfer protocol (HTTP) message, a web service message based on a simple object access protocol (SOAP) and/or a representational state transfer (REST) architecture.

When the holder of the transaction card <NUM> swipes the card at the POS terminal <NUM>, a card reader of the POS terminal <NUM> may retrieve information stored on the magnetic stripe of the transaction card <NUM>. The information stored on the magnetic stripe may include the transaction card number and its expiration date, along with the name of the holder of the transaction card <NUM>. The information retrieved by the card reader of the POS terminal <NUM> from the transaction card may then be used to approve or reject the transaction. To receive an approval status of the transaction, the POS terminal <NUM> may communicate to the application server <NUM> via the communications network <NUM>. The application server <NUM> may include a database to authenticate the transaction card and/or approve or reject the transaction. The application server <NUM> may then communicate to the POS terminal <NUM> whether the transaction has been approved or rejected. The POS terminal <NUM> then either allows the transaction to proceed if the transaction has been approved or shows an appropriate message to the holder of the transaction card <NUM> on a display of the POS terminal <NUM> if the transaction has been rejected.

A skimmer is an unauthorized device that works only on the POS terminal that uses a magnetic stripe reader. When a second magnetic stripe reader is fitted in a POS terminal adjacent to a primary magnetic stripe reader, a swipe of the transaction card <NUM> may result in the information stored on the magnetic stripe of the transaction to both the primary and second magnetic stripe readers. Swiping of the transaction card <NUM> through the primary and/or second magnetic card readers of the POS terminal <NUM> causes the transaction card <NUM> and/or the magnetic stripe reader(s) to vibrate because of the friction between the surface of the transaction card and the magnetic card reader(s). The vibration may cause sound in the air surrounding the transaction card. By way of a non-limiting example, because the vibrations may be transmitted as pressure waves in the air, vibration information may be received and recorded as sound by the microphone of the transaction card <NUM>. In another non-limiting example, because the vibrations may be transmitted through or across the material of the card itself, the vibration information may also or alternatively be recorded by the accelerometer of the transaction card. Accordingly, the microphone and/or the accelerometer of the transaction card <NUM> may act as a vibration sensor, as described in this disclosure.

The vibration information recorded by the vibration sensor, e.g., the microphone and/or the accelerometer of the transaction card <NUM>, when the POS terminal <NUM> includes only the primary magnetic stripe reader differs from the vibration information when the POS terminal <NUM> also includes the second magnetic stripe reader. Accordingly, the vibration information may be used to detect the skimmer. Based on the vibration information, if the skimmer is detected, then the state of the POS terminal <NUM> can be determined as being compromised.

By way of a non-limiting example, in some embodiments, when the vibration information is recorded as sound waves using the microphone of the transaction card <NUM>, a length of the time duration for which the sound is generated, two separate sounds instead of just one, and/or a frequency of sound may be considered to detect the skimmer. The sound waves recorded by the microphone of the transaction card <NUM> may be compared with one or more sound wave files from known compromised and/or uncompromised magnetic stripe card readers. The sound wave comparison may be performed by sound fingerprinting. Based on the result of the comparison, the state of the POS terminal <NUM> may be determined.

In some embodiments, the transaction card <NUM> may also include an accelerometer and/or a gyro sensor. Using the accelerometer and/or the gyro sensor, the processor on the transaction card may determine the intent of the holder of the transaction card <NUM>, for example based on a certain sequence of motions. If the determined intent corresponds to the transaction card being swiped through the card reader or being inserted into the card reader, the processor may turn on the microphone on the transaction card <NUM>. In an embodiment, the microphone is turned on for a limited duration, such as for two seconds. The microphone on the transaction card <NUM> may otherwise remain turned off for the privacy of the holder of the transaction card <NUM> and other people around him.

Accordingly, in an embodiment, the microphone is turned on as the transaction card <NUM> is about to be swiped through the card reader or being inserted into the card reader. The microphone then records the sound waves as the transaction card is being swiped through the card reader. The processor on the card may then store the recorded sound as audible information on the memory of the transaction card <NUM> before transmitting the audible information to the UE <NUM>.

In some embodiments, in addition to or instead of the microphone, the accelerometer of the transaction card <NUM> may be used to detect a skimmer. The accelerometer in the transaction card <NUM> may detect vibrations as the card is swiped through the card reader. When the transaction card <NUM> is swiped through the card reader fitted with the skimmer, the vibrations detected by the accelerometer in the transaction card <NUM> may be different from the vibrations detected when the card reader is not fitted with the skimmer. Accordingly, vibration patterns and/or recorded sound waves may be used to detect the skimmer.

In some embodiments, the processor of the transaction card <NUM> initiates a wireless communication link to the UE <NUM>. The UE <NUM> may be installed with an application that communicates with the transaction card <NUM> via the wireless communication link. The transaction card <NUM> may be configured to connect with the UE <NUM> using a specific communication protocol, such as Bluetooth, NFC, and/or Wi-Fi, etc. By way of non-limiting example, the UE <NUM> and the transaction card <NUM> both stay connected to each other via the wireless communication link for a predetermined time duration once the wireless communication link is established. In some embodiments, the predetermined time duration may be configurable. Accordingly, in some cases, the wireless communication link between the UE <NUM> and the transaction card <NUM> may not be required to be established when the transaction card <NUM> is being swiped.

In some embodiments, the processor of the transaction card <NUM> may transmit the vibration information to the UE <NUM> over the wireless communication link established between the UE <NUM> and the transaction card <NUM>. By way of non-limiting example, the vibration information may be processed by the application running on the UE <NUM> or the application server <NUM>. The processor of the transaction card <NUM> may process the vibration information, which, for example, may be as sound waves or vibration patterns.

However, processing of the vibration information by the processor of the transaction card <NUM> may quickly drain the battery on the transaction card <NUM>. Accordingly, in some embodiments, the UE <NUM> transmits the vibration information received from the transaction card <NUM> to the application server <NUM> via the communications network <NUM> for processing of the vibration information. The application server <NUM> may compare the received vibration information to a plurality of vibration information samples stored in the database. The plurality of vibration information samples in the database may have been previously received by the application server <NUM> from a plurality of POS terminals. Each vibration information sample file of the plurality of vibration information sample files stored in the database may indicate in its metadata or as a separate database field whether the vibration information sample corresponds to a skimmer or to a non-compromised terminal. By way of non-limiting example, additional information, such as a location of the POS terminal at which the vibration information is recorded, date, and timestamp of the recording, etc., may also be stored either in the metadata of the vibration information sample or in the database. Accordingly, when the vibration information is compared with the plurality of vibration information samples stored in the database of the application server <NUM> , the application server <NUM> may determine whether the vibration information matches with one or more vibration information samples that correspond to one or more skimmers. If it is determined that the vibration information corresponds to the one or more skimmers, the application server <NUM> may then take corrective measures, such as sending a warning message to one or more stakeholders, and/or rejecting the transaction being performed at the skimmer, etc. The one or more stakeholders may include, for example, the holder of the transaction card <NUM>, the owner of the POS terminal <NUM>, and/or one or more personnel at the customer care and/or fraud detection unit of the transaction card <NUM> issuing entity.

In some embodiments, the received vibration information may be stored at the database of the application server <NUM> for training a machine-learning algorithm, irrespective of whether the vibration information corresponds to the skimmer. The machine-learning algorithm may be used to determine whether the received vibration information corresponds to the skimmer.

In some embodiments, the received vibration information may be compared with previously received vibration information samples from the same location as the location of the POS terminal <NUM>, the UE <NUM> or the transaction card <NUM> over a preconfigured time duration. The preconfigured time duration may be, for example, one week, one month, two months, or three months, etc. Accordingly, the status of the POS terminal <NUM> may be determined based on which previously received vibration information sample the received vibration information matches and whether or not the previously received vibration information sample corresponds to the skimmer. In some embodiments, all of the previously received vibration information samples may be associated with card readers that are not skimmers. Accordingly, when the vibration information does not match with any of the previously received plurality of vibration information samples, then it may be determined that the vibration information is from a skimmer. The vibration information may be stored in the database along with information identifying a location of the skimmer, i.e., the POS terminal <NUM>, date and time stamp, and status as from a skimmer, etc..

In some embodiments, the UE <NUM> may not transmit the vibration information received from the transaction card <NUM> to the application server <NUM> but sends a request to receive one or more audio files stored in the database at the application server <NUM>. The request from the UE <NUM> to the application server <NUM> may also include a location of the UE <NUM>. Accordingly, the application server <NUM> may send one or more vibration information samples stored in the database corresponding to the location of the UE <NUM>, i.e., the POS terminal <NUM>, to the UE <NUM>. The UE <NUM> may determine if the vibration information corresponds to a skimmer using the same or similar procedure performed by the application server <NUM>. In addition, when the UE <NUM> determines that the vibration information corresponds to a skimmer, the UE <NUM> may notify the application server <NUM> to take the corrective measures as described above and transmit the vibration information received from the transaction card <NUM> to be stored in the database at the application server <NUM>.

In some embodiments, the one or more vibration information samples transmitted to the UE <NUM>, in response to the request to receiving vibration information samples stored in the database at the application server <NUM>, may all correspond to vibration information samples not from a skimmer, from the same location as the UE <NUM> or the transaction card <NUM>, i.e., the location of the POS terminal <NUM>, or a different location. The UE <NUM> may then identify the vibration information received from the transaction card <NUM> as from a skimmer if the vibration information does not match with any of the one or more vibration information samples received from the application server <NUM>. And, as described above, the UE <NUM> may notify the application server <NUM> to take the corrective measures described above and transmit the recorded sound received from the transaction card <NUM> to be stored in the database at the application server <NUM>.

In some embodiments, by way of non-limiting example, the database may be a database in the cloud or in another server, and may not be physically located at the same location as the application server <NUM>.

<FIG> is a flowchart illustrating a method for detecting a skimmer, according to some embodiments. An application server, such as the application server <NUM>, may perform the method steps shown in <FIG>. As shown in <FIG>, at step <NUM>, the application server <NUM> may receive from the UE <NUM> the vibration information recorded by the vibration sensor, e.g., the microphone and/or the accelerometer of the transaction card <NUM>, while swiping the transaction card <NUM> into the card reader for the execution of a transaction at the POS terminal <NUM>. The POS terminal <NUM> may be one of the plurality of POS terminals at the location, such as a bank, a restaurant, and/or a grocery shop, etc. As described above, along with the vibration information, the application server <NUM> may also receive location information corresponding to the UE <NUM> and/or the transaction card <NUM>. The location of the UE <NUM> may be determined by the UE <NUM> using, for example, global positioning system (GPS) signals or multilateration of radio signals received by the UE <NUM> from various cell towers. The transaction card <NUM> may also determine the location of the transaction card using a similar method used by the UE <NUM>.

In accordance with some embodiments, at step <NUM>, the application server <NUM> may determine a state of the POS terminal <NUM> based on the received vibration information. As described above, the application server <NUM> may compare the received vibration information using a comparison technique, for example, sound fingerprinting, or machine learning algorithm with the plurality of vibration information samples stored in the database. In an embodiment, where each vibration information sample of the plurality of vibration information samples stored in the database indicates whether the vibration information sample corresponds to a skimmer, the application server may determine if the received vibration information is from a skimmer.

In accordance with some embodiments, at step <NUM>, the application server <NUM> may send a warning message to the one or more stakeholders of the transaction in response to determining that the card reader of the POS terminal <NUM> is compromised at step <NUM>. In addition to sending the warning message, the application server may reject the transaction being performed at the POS terminal <NUM>.

<FIG> is another flowchart illustrating a method for detecting a skimmer, according to some embodiments. At step <NUM>, the application server <NUM> may determine the location of the POS terminal <NUM> based on the location of the UE <NUM> or the transaction card <NUM>. At step <NUM>, received vibration information is compared with a plurality of vibration information samples stored in the database and received from one or more POS terminals that share the same location as the location of the UE <NUM> or the transaction card <NUM>. At step <NUM>, it may be determined, based on the comparison, that the vibration information is different from the plurality of vibration information samples from the POS terminal(s) at the same location. At step <NUM>, in response to the determination that the vibration information is different, the application server <NUM> may identify the POS terminal <NUM> as being compromised, and take the corrective actions as stated above.

<FIG> is another flowchart illustrating a method for detecting a skimmer, according to some embodiments. At step <NUM>, the application server <NUM> may determine the location of the POS terminal <NUM> based on the location of the UE <NUM> or the transaction card <NUM>. At step <NUM>, at least one vibration information sample of the plurality of vibration information samples received from at least one POS terminal at the location of the UE <NUM> or the transaction card <NUM> may be transferred to the UE <NUM>. The at least one vibration information sample transferred to the UE <NUM> may be one of the plurality of vibration information samples received by the application server <NUM> over a configurable time period. At step <NUM>, the application server may receive a notification from the UE <NUM> regarding the status of the POS terminal <NUM>. The status of the POS terminal <NUM> may be determined as being compromised based on a comparison of the vibration information with the at least one vibration information sample and identified as not matching with the at least one vibration information sample transferred to the UE <NUM>.

<FIG> illustrates an example computer system in accordance with some embodiments.

Various embodiments may be implemented, for example, using one or more well-known computer systems, such as a computer system <NUM>, as shown in <FIG>. One or more computer systems <NUM> may be used, for example, to implement any of the embodiments discussed herein, as well as combinations and sub-combinations thereof. The computer systems <NUM> may be used for the implementation of one or more embodiments described above.

The computer system <NUM> may include one or more processors (also called central processing units, or CPUs), such as a processor <NUM>. The processor <NUM> may be connected to a communication infrastructure or bus <NUM>.

The computer system <NUM> may also include user input/output device(s) <NUM>, such as monitors, keyboards, pointing devices, etc., which may communicate with communication infrastructure <NUM> through user input/output interface(s) <NUM>.

One or more processors <NUM> may be a graphics processing unit (GPU). In an embodiment, a GPU may be a processor that is a specialized electronic circuit designed to process mathematically intensive applications. The GPU may have a parallel structure that is efficient for parallel processing of large blocks of data, such as mathematically intensive data common to computer graphics applications, images, videos, etc..

The computer system <NUM> may also include a main or primary memory <NUM>, such as random access memory (RAM). Main memory <NUM> may include one or more levels of cache. Main memory <NUM> may have stored therein control logic (i.e., computer software) and/or data.

The computer system <NUM> may also include one or more secondary storage devices or memory <NUM>. The secondary memory <NUM> may include, for example, a hard disk drive <NUM> and/or a removable storage device or drive <NUM>. The removable storage drive <NUM> may be a floppy disk drive, a magnetic tape drive, a compact disk drive, an optical storage device, tape backup device, and/or any other storage device or storage drive.

The removable storage drive <NUM> may interact with a removable storage unit <NUM>. The removable storage unit <NUM> may include a computer-usable or readable storage device having stored thereon computer software (control logic) and/or data. The removable storage unit <NUM> may be a floppy disk, magnetic tape, compact disk, DVD, optical storage disk, and/ any other computer data storage device. The removable storage drive <NUM> may read from and/or write to the removable storage unit <NUM>.

The secondary memory <NUM> may include other means, devices, components, instrumentalities, or other approaches for allowing computer programs and/or other instructions and/or data to be accessed by the computer system <NUM>. Such means, devices, components, instrumentalities, or other approaches may include, for example, a removable storage unit <NUM> and an interface <NUM>. Examples of the removable storage unit <NUM> and the interface <NUM> may include a program cartridge and cartridge interface (such as that found in video game devices), a removable memory chip (such as an EPROM or PROM) and associated socket, a memory stick and USB port, a memory card and associated memory card slot, and/or any other removable storage unit and associated interface.

The computer system <NUM> may further include a communication or network interface <NUM>. The communication interface <NUM> may enable the computer system <NUM> to communicate and interact with any combination of external devices, external networks, external entities, etc. (individually and collectively referenced by reference number <NUM>). For example, the communication interface <NUM> may allow the computer system <NUM> to communicate with the external or remote devices <NUM> over communications path <NUM>, which may be wired and/or wireless (or a combination thereof), and which may include any combination of LANs, WANs, the Internet, etc. Control logic and/or data may be transmitted to and from the computer system <NUM> via the communication path <NUM>.

The computer system <NUM> may also be any of a personal digital assistant (PDA), desktop workstation, laptop or notebook computer, netbook, tablet, smartphone, smartwatch or other wearable, appliance, part of the Internet-of-Things, and/or embedded system, to name a few non-limiting examples, or any combination thereof.

The computer system <NUM> may be a client or server, accessing or hosting any applications and/or data through any delivery paradigm, including but not limited to remote or distributed cloud computing solutions; local or on-premises software ("on-premise" cloud-based solutions); "as a service" models (e.g., content as a service (CaaS), digital content as a service (DCaaS), software as a service (SaaS), managed software as a service (MSaaS), platform as a service (PaaS), desktop as a service (DaaS), framework as a service (FaaS), backend as a service (BaaS), mobile backend as a service (MBaaS), infrastructure as a service (IaaS), etc.); and/or a hybrid model including any combination of the foregoing examples or other services or delivery paradigms.

Any applicable data structures, file formats, and schemas in the computer system <NUM> may be derived from standards including but not limited to JavaScript Object Notation (JSON), Extensible Markup Language (XML), Yet Another Markup Language (YAML), Extensible Hypertext Markup Language (XHTML), Wireless Markup Language (WML), MessagePack, XML User Interface Language (XUL), or any other functionally similar representations alone or in combination. Alternatively, proprietary data structures, formats, or schemas may be used, either exclusively or in combination with known or open standards.

In accordance with some embodiments, a tangible, non-transitory apparatus or article of manufacture comprising a tangible, non-transitory computer useable or readable medium having control logic (software) stored thereon may also be referred to herein as a computer program product or program storage device. This includes, but is not limited to, the computer system <NUM>, the main memory <NUM>, the secondary memory <NUM>, and the removable storage units <NUM> and <NUM>, as well as tangible articles of manufacture embodying any combination of the foregoing. Such control logic, when executed by one or more data processing devices (such as the computer system <NUM>), may cause such data processing devices to operate as described herein.

The foregoing description of the specific embodiments will so fully reveal the general nature of the disclosure that others can, by applying knowledge within the skill of the art, readily modify and/or adapt for various applications such specific embodiments, without undue experimentation, without departing from the general concept of the present disclosure. Therefore, such adaptations and modifications are intended to be within the meaning and range of equivalents of the disclosed embodiments, based on the teaching and guidance presented herein. It is to be understood that the phraseology or terminology herein is for the purpose of description and not of limitation, such that the terminology or phraseology of the present specification is to be interpreted by the skilled artisan in light of the teachings and guidance.

Claim 1:
A system, comprising:
a memory (<NUM>, <NUM>); and
a processor (<NUM>), communicatively coupled to the memory, configured to perform operations stored in the memory, characterised in that the operations comprise:
receiving (<NUM>), from a user equipment (UE), vibration information recorded by a vibration sensor on a transaction card in response to an execution of a transaction at a point-of-service (POS) terminal of a plurality of POS terminals using the transaction card, the vibration information caused by the transaction card being swiped through the POS terminal or inserted into or removed from the POS terminal;
determining (<NUM>) a state of the POS terminal based on the vibration information; and
in response to determination of the state of the POS terminal as being compromised, sending (<NUM>) to one or more stakeholders of the transaction a warning message containing the state of the POS terminal and POS terminal information,
wherein the vibration information is received from the transaction card via a communication link between the transaction card and the UE.