An elevator vandalism monitoring system is configured to determine if an act of vandalism upon a component of an elevator system has occurred. The vandalism monitoring system includes a sensor, a processor, an electronic storage medium, a model, and a comparison module. The sensor is configured to monitor a detectable parameter associated with the component, and output a detectable parameter signal. The processor is configured to receive the detectable parameter signal. The model is stored in the electronic storage medium, and is associated with an expected parameter. The comparison module is executed by the processor, and is configured to generally compare the model to the detectable parameter signal for determining if a parameter anomaly exists.