A method for monitoring a physical area for unauthorized access by a user of a wireless device, includes scanning for signals from a wireless device, detecting a wireless signal from a wireless device, determining a wireless device ID associated with the wireless signal, determining whether the wireless device ID matches a wireless ID in an authorized or unauthorized ID list and in response to determining that the wireless device ID matches a wireless ID in the unauthorized wireless ID list, activate a security alert. The method may further include in response to determining, that the wireless device ID does not match a wireless ID in the authorized wireless ID list nor the unauthorized wireless ID list, receiving, signal strength information associated with the detected wireless signal for a predetermined time interval and determining a pattern as a function of time of the received signal strength.