A method for detecting an unauthorized programming or installation of software on an electronic module on a vehicle. The method obtains information regarding programming of the electronic module. The information may be obtained by detecting a programming session of the electronic module or after the module has been programmed. The obtained information is compared with information identifying whether programming of the electronic module is authorized or unauthorized. A determination whether the programming is authorized or unauthorized is made based on the comparison.