Systems and methods for detecting replay attacks may use one or more sensors to collect data about a state of a device. The device may be used to perform a transaction. The device may be used to authenticate or identify a user. The state of the device may pertain to a characteristic of the device position, movement, component, or may pertain to one or more environmental conditions around the device. The state of the device may be expected to change over time, and certain states are unlikely to be repeated. The detected repetition of a state of the device may be a cause for increasing the likelihood that a replay attack is taking place.