Unauthorized use of fleet vehicles is detected by matching drivers' logged out times with vehicle movements for which there is no logged in driver. Allowance is made for vehicles that may be moved within permitted areas without a logged in driver. A likelihood value is assigned to each candidate driver whose logged out time corresponds to the duration of unauthorized movement of the vehicle. The likelihood value is increased if the candidate driver is the next driver to log into the vehicle after its unauthorized usage.