A payment terminal can have an integrated memory scanning system that has direct access to the memory of the payment terminal. By having direct access to the memory of the payment terminal, the memory scanning system can access information about the operating system and the applications of the payment terminal to determine if the operating system or applications are performing unauthorized or forbidden actions, which may indicate that a fraudulent transaction or tamper attempt is occurring at the payment terminal. The memory scanning system can determine if an unauthorized action is occurring by comparing the information regarding the operating system or applications obtained from the memory to test criteria stored by the memory scanning system. In addition, the memory scanning system can also have a direct communications with a payment server using information from a network stack in memory that can be accessed directly by the memory scanning system.