An apparatus is configured to receive a complaint initiation signal that includes an indication that a card reader may be compromised, and initiation date and time of the complaint, and geolocation data related to the reporting party. The apparatus is further configured to identify a street address closest to the geolocation data in the complaint using a geolocation application programming interface and the set of geolocation data. The apparatus is also configured to determine that the identified street address is associated with an entity. The apparatus then calculates a confidence interval as to whether that entity is the type of entity that uses a card reader. The apparatus is further configured to determine that the confidence interval exceeds a threshold. The apparatus is also configured to determine an identifier of the entity. Further, the apparatus is configured to publish an alert to a data feed.