Disclosed is an apparatus and method for a mobile device to detect unexpected behavior associated with the mobile device. The mobile device may include a memory and a processor coupled to the memory. The processor may be configured to monitor at least one of physical conditions and/or device actions associated with the mobile device. If a call or a data transmission is requested, the processor may be configured to compare the monitored physical conditions and/or device actions to an anomaly threshold value and may execute an anomaly exception routine if the anomaly threshold value is exceeded.