A computer-implemented method of securing a device, the method comprising: first detecting that an application on said device has been used in a way that is consistent with illicit use of said device, wherein the illicit use of said device is identified by detecting one or more of the following actions: authorizing an application that is known to be a thief tool for use on said device, using said device to access an online service account of a legitimate user of said device, authorizing an application, that is known to be a thief tool, to use data of a legitimate user on said online service, and forwarding more than a pre-determined quantity of e-mail stored on said device to a location outside of said device; second detecting that said device is being handled in a way that is inconsistent with pressure patterns representative of an amount of pressure that a legitimate user applies when holding the device or when tapping on a screen of the device, or acceleration patterns of known legitimate users of said device that are representative of patterns of acceleration on the device; in response to said first detecting and said second detecting, taking an action to protect said device from unauthorized use, said action comprising locking a user interface of said device to prevent further user interaction with said device or disabling a communication facility of said device to prevent said device from communicating with devices outside of said device. first detecting that an application on said device has been used in a way that is consistent with illicit use of said device, wherein the illicit use of said device is identified by detecting one or more of the following actions: authorizing an application that is known to be a thief tool for use on said device, using said device to access an online service account of a legitimate user of said device, authorizing an application, that is known to be a thief tool, to use data of a legitimate user on said online service, and forwarding more than a pre-determined quantity of e-mail stored on said device to a location outside of said device; authorizing an application that is known to be a thief tool for use on said device, using said device to access an online service account of a legitimate user of said device, authorizing an application, that is known to be a thief tool, to use data of a legitimate user on said online service, and forwarding more than a pre-determined quantity of e-mail stored on said device to a location outside of said device; second detecting that said device is being handled in a way that is inconsistent with pressure patterns representative of an amount of pressure that a legitimate user applies when holding the device or when tapping on a screen of the device, or acceleration patterns of known legitimate users of said device that are representative of patterns of acceleration on the device; in response to said first detecting and said second detecting, taking an action to protect said device from unauthorized use, said action comprising locking a user interface of said device to prevent further user interaction with said device or disabling a communication facility of said device to prevent said device from communicating with devices outside of said device.