Apparatus, system and method for authenticating access to a vehicle, where vehicle events, such as a door lock condition or an operating condition of the vehicle, are reported to an authentication network. Vehicle events are compared to a vehicle schedule to determine if the vehicle events comply with the schedule using authentication rules. If the events are not compliant, an authentication request signal, requiring a predetermined authentication response, is transmitted to the vehicle. Access to the vehicle may be denied until a match to the predetermined authentication response is received. Authentication may include the use of a portable device, which may act as an intermediary between the vehicle and the authentication system. Vehicle events may further be reported to the portable device. Authentication rules may be updated automatically based on further incoming vehicle events, or may be updated manually using a computer.