Most strange phone behaviour is not hacking
A phone that runs hot, slows down or drains its battery has usually just aged, run a heavy app or hit a bad update. Real compromise is rarer, and it leaves different traces: apps you did not install, settings you did not change, and activity on your accounts that was not you.
This guide separates the two, shows you where to look on iPhone and Android, and gives you a clear order of steps if you find something.
The signs that actually matter
Treat these as strong signals, especially when you see more than one:
- An app you do not remember installing, particularly one with a generic name like "System Service", "Device Health" or "Wi-Fi Update".
- Accessibility or device-admin access granted to an app you do not trust. On Android this level of access lets an app read your screen and tap for you, so stalkerware relies on it.
- A configuration or MDM profile on an iPhone that you did not add and that is not from your employer or school.
- Login alerts, password-reset emails or 2-step codes you did not request. These usually mean someone is trying your accounts, which is often the real target.
- Messages sent from your WhatsApp, email or social accounts that you did not write.
- Your number suddenly loses signal and shows "No service" for no reason, followed by account resets. That pattern can mean a SIM swap, where someone moves your number to their SIM.
Signs that are usually something else
These alone rarely mean a hack:
| What you notice | More likely cause |
|---|---|
| Battery drains faster | Battery wear, a recent update, poor signal, bright screen |
| Phone feels hot | Charging, gaming, camera use, hot weather |
| Phone is slow | Low storage, old hardware, too many background apps |
| Strange pop-up ads | An ad-heavy app or a website, not system spyware |
| Higher data usage | Auto-updates, cloud photo backup, video autoplay |
Check the boring explanations first: storage, battery health and recent updates. If those explain it, you can stop worrying.
How to check an iPhone
Work through these in Settings:
- General > VPN & Device Management. If you see a profile you do not recognise, tap it, read what it is, and remove it unless it belongs to your work or school.
- Privacy & Security > Safety Check. This shows which people and apps have access to your location, photos and other data, and lets you revoke it in one place. Its "Emergency Reset" option is designed for exactly this situation.
- [Your name] at the top > scroll down to the device list. Remove any device that is not yours. Then change your Apple Account password.
- Privacy & Security > Location Services and Camera / Microphone. Turn off access for anything you do not need.
- General > Software Update. Install the latest version. Updates close the security holes that spyware depends on.
If you are at high risk, for example as a journalist or activist, Apple's Lockdown Mode (Privacy & Security > Lockdown Mode) blocks many of the attack routes used by commercial spyware.
How to check an Android phone
Menu names vary by brand, but the places to look are the same:
- Settings > Apps > See all apps. Sort through the list and uninstall anything unfamiliar. Search the name online before deleting something that might be part of the system.
- Settings > Accessibility > Installed apps (or Downloaded services). Only apps you chose should be here. Turn off and uninstall anything else.
- Settings > Security > Device admin apps (sometimes under "More security settings"). Revoke admin rights from anything you do not recognise. This often has to be done before the app can be uninstalled.
- Play Store > your profile icon > Play Protect. Run a scan and make sure "Scan apps with Play Protect" is on.
- Settings > Google > Manage your Google Account > Security. Review "Your devices" and recent security activity, and sign out anything unknown.
What to do if your phone has been compromised
Order matters. Secure the accounts first, from a different, trusted device if you can, because anything you type on a compromised phone may be visible.
1. Change the passwords that unlock everything else
Start with your main email account and your Apple Account or Google Account, then banking and WhatsApp. Use a new, unique password for each. A password manager makes this realistic.
2. Sign out every other session
Google, Apple, Facebook, Instagram, WhatsApp (Linked devices) and most banks let you sign out all other devices. Do this straight after changing each password.
3. Turn on two-step verification with an app or passkey
SMS codes are better than nothing, but an authenticator app or a passkey is much harder to steal, especially if a SIM swap is possible.
4. Call your mobile network if your number went dead
If your phone lost service unexpectedly, ask your provider whether a SIM change was made and request a SIM lock or a port-out PIN.
5. Remove the threat from the phone
Uninstall the suspicious app, remove rogue profiles or admin rights, and update the system. If you cannot find the cause, or the phone was in someone else's hands, back up only your photos and contacts, then factory reset it. Do not restore a full backup taken after the problem started, because it can bring the problem back.
6. Watch your accounts for a few weeks
Look out for login alerts, unfamiliar transactions and messages you did not send.
If someone close to you may be tracking you
Stalkerware is most often installed by someone with physical access to the phone: a partner, ex-partner or family member. If that is your situation, think about safety before removing anything, because removing it can alert the person. Organisations that support people facing domestic abuse can help you plan, and iPhone's Safety Check was built with this case in mind.
Keep it from happening again
- Install apps only from the App Store or Google Play.
- Keep automatic updates on.
- Use a screen lock that is not easy to guess, and do not share it.
- Treat unexpected links in SMS, WhatsApp and email with suspicion. Our guide to spotting scam texts and phishing covers the common tricks.
- If your phone is lost or stolen, act quickly with our lost phone recovery guide.