Information protection schemes on mobile phones become important challenges because mobile phones have many types of private information. In general, user authentication and anomaly detection are effective to prevent attacks by illegal users. However, the user authentication can be applied only at the beginning of use and the conventional anomaly detection is not suited for mobile phones, only but computer systems. In this paper, we propose a simple and easy-to-use anomaly detection scheme on mobile phones. The scheme records the keystrokes as the mobile phone is operated, and an anomaly detection algorithm calculates a score of similarity, to detect illegal users. We implemented a prototype system on the BREW (Binary Run-time Environment for Wireless) emulator and evaluated error rates by using results from 15 testers. From experiments results, we show the proposed scheme is able to apply the anomaly detection by checking the similarity score several times.