Methods, computer-readable media, software, and apparatuses may retrieve, from a computing device at a vehicle, driving data, and determine, based on the driving data, a range of time when a driver of the vehicle has a low likelihood of accessing a web resource over a network. An online activity may be detected for an account associated with the driver. In some aspects, a time of the online activity may be compared to the range of time. Based upon a determination that the time of the online activity is within the range of time, a potentially unauthorized activity may be identified. In some aspects, in response to the potentially unauthorized activity, one or more steps may be triggered to protect the driver from the potentially unauthorized activity.