Methods, systems, computer-readable media, and apparatuses may provide a mobile device with the ability to locally detect fraudulent activity by an unauthorized user. A mobile device may include a fraud detection module that may build a historical usage pattern of a user of the mobile device. The fraud detection module may monitor usage of the mobile device for multiple parameters and record events pertaining to the parameters. Periodically or in response to each event, the fraud detection module may compute a current usage pattern using each of the current parameter values. The fraud detection module may compare the current usage pattern with the historical usage pattern and may use the comparison result to compute a confidence score. The fraud detection module may then compare the confidence score with a preset confidence score to determine whether fraudulent activity is occurring at the mobile device.