Monitoring a physical area for detection of a wireless device includes scanning for signals from a wireless device within a scanning range defining the physical area, detecting a wireless signal from a wireless device within the scanning range, determining a wireless device ID associated with the wireless device detected within the scanning range and determining whether the wireless device ID is unknown. In response to determining that the wireless device ID is unknown, analyzing the wireless signal to determine scan data representative of the wireless signal, monitoring the scan data over time, determining a scan data pattern as a function of time based on the monitored scan data, comparing the scan data pattern to scan data patterns stored in a database and in response to determining that the scan data pattern based on the monitored scan data matches a scan data pattern in the database, activate a first alert.