Vehicle tampering leads to substantial excessive emissions, but few methods could identify the tampered ones from vehicles on road accurately in one day or less. A fast response model based on real time data from terminal box (T-BOX) was built in this study for heavy-duty vehicle tampering identification, which could identify the tampered vehicles from vehicles with excessive emission caused by bad driving conditions, low ambient temperature or on-board diagnostic (OBD) faults. By analyzing the existing means of tampering in the last decade, the vehicle tampering identification model was established according to the data characteristics of tampered vehicles. Two main modules based on emission and emission factors were built and three corrections were added in the model to avoid disturbances led to misjudge. In our research, 66 heavy-duty vehicles from the big data platform were used to screen for vehicle tampering. It was found that 15 vehicles existed excessive emissions, and 2 vehicles were tampered. Tampered vehicles only account for 3% of the sample, but emitted 1.4 times nitrogen oxides (NOx) of total emission of other vehicles. The model solved the problem that the traditional model could not identify the vehicle tampering accurately. It could be used in emission accounting and management of tampered vehicles for government.