Methods and systems for addressing unreported theft or loss of mobile communications devices

A method comprising:

• by a security component on a first mobile communications device, causing the storage of a usage pattern associated with an authorized user of the first mobile communications device, the stored usage pattern created based only on usage information from use of a second mobile communications device by the authorized user of the first mobile communications device, and the stored usage pattern modified, by a server, for use on the first mobile communications device based on differences between the first mobile communications device and the second mobile communications device;
• detecting, by the security component on the first mobile communications device, an event related to the first mobile communications device;
• comparing, by the security component, the detected event to the stored usage pattern to determine if there is a difference between the detected event and the stored usage pattern;
• associating, by the security component, a measure with the stored usage pattern when there is a difference between the detected event and the stored usage pattern;
• determining, by the security component, that the detected event was not caused by the authorized user of the first mobile communications device when the associated measure is beyond a threshold measure;
• and
• in response to the determination, issuing a command by the security component, the command causing a restriction of an ability of the first mobile communications device to be used to access a resource.

A non-transitory, computer-readable storage medium having stored thereon a plurality of instructions, which, when executed by a processor of a mobile communications device, cause the mobile communications device to perform actions comprising:

• causing the storage of a usage pattern associated with an authorized user of the first mobile communications device, the stored usage pattern created based only on usage information from use of a second mobile communications device by the authorized user of the first mobile communications device, and the stored usage pattern modified, by a server, for use on the first mobile communications device based on differences between the first mobile communications device and the second mobile communications device;
• detecting a usage of the first mobile communications device or an event related to the first mobile communications device;
• comparing the detected usage to the stored usage pattern to determine if there is a difference between the detected usage and the stored usage pattern;
• associating a measure with the stored usage pattern when there is a difference between the detected usage and the stored usage pattern;
• determining that the detected usage was not caused by the authorized user of the first mobile communications device when the associated measure is beyond a threshold measure;
• and
• in response to the determination, issuing a first command causing a restriction of an ability of the first mobile communications device to be used to access a resource.

A system, comprising a mobile communications device with at least one processor and memory and instructions that when executed by the at least one processor cause the mobile communications device to perform actions comprising:

• causing the storage of a usage pattern associated with an authorized user of the first mobile communications device, the stored usage pattern created based only on usage information from use of a second mobile communications device by the authorized user of the first mobile communications device, and the stored usage pattern modified, by a server, for use on the first mobile communications device based on differences between the first mobile communications device and the second mobile communications device;
• detecting a usage of the first mobile communications device or an event related to the first mobile communications device;
• comparing the detected usage to the stored usage pattern to determine if there is a difference between the detected usage and the stored usage pattern;
• associating a measure with the stored usage pattern when there is a difference between the detected usage and the stored usage pattern;
• determining that the detected usage was not caused by the authorized user of the first mobile communications device when the associated measure is beyond a threshold measure;
• and
• in response to the determination, issuing a first command causing a restriction of an ability of the first mobile communications device to be used to access a resource.