In some embodiments, generating the incident report based on the trigger data may comprise comparing phone sensor data from the phone of the driver to standard conditions. For example, standard conditions may include remaining mostly level, a constant light sensor reading, a distant reading from a proximity sensor, the phone being plugged in and charging, and a high battery level. In some embodiments, the standard sensor information may include the phone remaining level throughout the duration of a trip. In some embodiments, the standard sensor information may include the phone remaining plugged in throughout the duration of a trip. In some embodiments, the standard sensor information may include detecting a high amount of light by the light sensor. Abnormal phone sensor data may include a rapid change in orientation, a change to a low light level, a reduction in the distance reading from the proximity sensor, and the phone becoming unplugged during a trip.

In some embodiments, the alert component 118 may determine that an incident has occurred in response to the comparison of the phone sensor data to standard conditions. For example, the comparison may indicate that the driver's phone has been grabbed by the passenger, and the passenger has put the driver's phone in their pocket. In some embodiments, an incident report may be generated for the incident. In some embodiments, it may be determined that the phone of the driver has been grabbed based on the acceleration data. The trigger data may include an indication that the phone has been grabbed. In some embodiments, it may be determined whether the phone of the driver is inside a pocket using the proximity data. In some embodiments, the alert component 118 may filter out false alert notifications using trip status information. For example, if a driver continues to a destination, it may be determined that the trigger data is a false positive.