A method is provided for detecting use of unauthorized software in an engine control unit provided in a vehicle. The method includes calculating a Checksum Verification Number (CVN) each time the engine is started, comparing a last calculated CVN with a last stored CVN in a list of a plurality of CVN entries, storing the last calculated CVN if the last calculated CVN is different to the last stored CVN together with a date of an entry in the list of CVN and/or the current odometer status, removing entries in the list of CVN according to FIFO principle when the list of CVN is full, and presenting this upon request from an on-board or off-board tool.