Various embodiments relate to systems and methods for detecting an unauthorized use of a vehicle. One or more facial images of one or more authorized drivers of a vehicle may be stored on a vehicle computing system. After detecting movement of the vehicle, one or more facial images of a driver of the vehicle may be periodically received from at least one in-vehicle camera. The one or more captured facial images of the driver may be periodically processed based on the stored facial images of the one or more authorized drivers to determine if the driver is an authorized driver. If the driver is not an authorized driver based on the periodic determination, vehicle operation may be disabled. If the driver is authorized based on the periodic determination, operation of the vehicle may continue.