Method of detecting abnormal use of a security processor invoked by at least one receiving terminal in order to control access to a scrambled digital content supplied by at least one operator to said receiving terminal wherein, each invocation of the security processor consists in presenting it with an ECM access control message associated with the scrambled content and carrying a control word CW and the description of at least one access condition in order to supply the terminal with the control word for unscrambling the content, method characterised in that it comprises the following steps: - analysing security processor use during a preset observation period T obs comprising a period of activity T Act of said security processor constituted by accumulating a plurality of successive periods of activity separated by a minimum period T InaMin of inactivity of said security processor, - counting on the basis of said analysis the number N Ecm of ECM messages processed by the security processor during a period of activity T Act, - determining the mean value M ECM of the number of invocations per time unit of said security processor during said observation of activity T Act, - comparing said mean value M ECM with a preset threshold S max, and - if the mean value M ECM is greater than the threshold S max, applying to said terminal a sanction whereof the level of severity increases progressively, wherein, at a current date t c, counting the number N ECM of successfully processed contemporary ECM messages comprises the following operations: - comparing the date t with the date (t C -T Diff), T Diff representing a previously specified minimum delay separating the date t and the date t c, - increasing the number N ECM if the date (t C -T Diff) is less than or equal to the transmission date t of said message, otherwise maintaining the number N ECM at the current value, - if the date t is between the date t C and the date t C +T InaMin, increasing the period of activity T Act by the value (t-t C), otherwise maintaining the period of activity T Act at the current value. - analysing security processor use during a preset observation period T obs comprising a period of activity T Act of said security processor constituted by accumulating a plurality of successive periods of activity separated by a minimum period T InaMin of inactivity of said security processor, - counting on the basis of said analysis the number N Ecm of ECM messages processed by the security processor during a period of activity T Act, - determining the mean value M ECM of the number of invocations per time unit of said security processor during said observation of activity T Act, - comparing said mean value M ECM with a preset threshold S max, and - if the mean value M ECM is greater than the threshold S max, applying to said terminal a sanction whereof the level of severity increases progressively, - comparing the date t with the date (t C -T Diff), T Diff representing a previously specified minimum delay separating the date t and the date t c, - increasing the number N ECM if the date (t C -T Diff) is less than or equal to the transmission date t of said message, otherwise maintaining the number N ECM at the current value, - if the date t is between the date t C and the date t C +T InaMin, increasing the period of activity T Act by the value (t-t C), otherwise maintaining the period of activity T Act at the current value.