A computer-implemented method of securing a device , the method comprising: first detecting that an application on said device has been used in a way that is consistent with illicit use of said device , wherein the illicit use of said device is identified by detecting one or more of the following actions: authorizing an application that is known to be a thief tool for use on said device , using said device to access an online service account of a legitimate user of said device , authorizing an application, that is known to be a thief tool, to use data of a legitimate user on said online service, and forwarding more than a pre-determined quantity of e-mail stored on said device to a location outside of said device ; second detecting that said device is being handled in a way that is inconsistent with pressure patterns representative of an amount of pressure that a legitimate user applies when holding the device or when tapping on a screen of the device , or acceleration patterns of known legitimate users of said device that are representative of patterns of acceleration on the device ; in response to said first detecting and said second detecting, taking an action to protect said device from unauthorized use, said action comprising locking a user interface of said device to prevent further user interaction with said device or disabling a communication facility of said device to prevent said device from communicating with devices outside of said device . first detecting that an application on said device has been used in a way that is consistent with illicit use of said device , wherein the illicit use of said device is identified by detecting one or more of the following actions: authorizing an application that is known to be a thief tool for use on said device , using said device to access an online service account of a legitimate user of said device , authorizing an application, that is known to be a thief tool, to use data of a legitimate user on said online service, and forwarding more than a pre-determined quantity of e-mail stored on said device to a location outside of said device ; authorizing an application that is known to be a thief tool for use on said device , using said device to access an online service account of a legitimate user of said device , authorizing an application, that is known to be a thief tool, to use data of a legitimate user on said online service, and forwarding more than a pre-determined quantity of e-mail stored on said device to a location outside of said device ; second detecting that said device is being handled in a way that is inconsistent with pressure patterns representative of an amount of pressure that a legitimate user applies when holding the device or when tapping on a screen of the device , or acceleration patterns of known legitimate users of said device that are representative of patterns of acceleration on the device ; in response to said first detecting and said second detecting, taking an action to protect said device from unauthorized use, said action comprising locking a user interface of said device to prevent further user interaction with said device or disabling a communication facility of said device to prevent said device from communicating with devices outside of said device . <EOS>