A system and method for detecting compromise of financial transaction instruments associated with a merchant or automated teller machine (ATM) are disclosed. Historical data representing a historical aggregate financial transaction instrument behavior history is stored in a computer memory. The historical data is received at the computer from one or more merchants and ATMs via a communications network. Authorization data representing authorization behavior of a plurality of financial transaction cards related to corresponding financial transactions at the same or a different one or more merchants and ATMs is received by the computer. Abnormal activity data representing an abnormal aggregate financial transaction instrument activity based on the authorization data is determined, and the historical data is compared with the abnormal activity data to generate a compromise profile for the plurality of financial transaction instruments.