How to Tell If Your Phone Is Hacked: 12 Warning Signs on iPhone and Android (and What to Do)

The fastest way to tell if your phone is hacked is to look for evidence, not symptoms: an unknown configuration or MDM profile, an app with device-admin or accessibility rights you never granted, a sign-in on your Apple or Google account from a device you don’t own, or a security alert from Apple or Google itself. Slow performance and a warm battery on their own rarely mean anything. This guide shows you how to tell if your phone is hacked on iPhone and Android, which signs are real and which are myths, and exactly what to do next.

Most “hacked phone” cases fall into three groups: an account takeover (someone has your Apple Account, Google Account, WhatsApp or email), a malicious or monitoring app installed on the phone (stalkerware, banking trojans, adware), or a rogue management profile. Truly remote, zero-click spyware exists, but it is expensive and aimed at a small number of journalists, activists, officials and executives. Start with the common causes and work up.

Is my phone hacked? 12 warning signs that actually matter

No single sign proves a compromise. Look for two or three together, especially if they started at the same time or after someone had your unlocked phone in their hands.

1. An Apple or Google security alert. Apple threat notifications and Google “suspicious sign-in” or Play Protect warnings are the strongest signal you will get. Treat them seriously.
2. A profile you didn’t install. On iPhone, anything in Settings › General › VPN & Device Management on a personal phone deserves a close look.
3. Unknown device-admin or accessibility apps on Android. These permissions let an app read the screen, tap buttons for you or block its own removal.
4. Unfamiliar devices on your account. A phone, tablet or browser you don’t recognize in your Apple Account or Google Account device list.
5. Password-reset or 2FA codes you didn’t request. Someone is trying your accounts, and may be one step from success.
6. Sudden loss of mobile service. “No Service” or “SOS only” while people around you have signal can mean your number was moved to another SIM (SIM swap).
7. Someone knows things they shouldn’t. A partner or ex who quotes your private messages or turns up where you are is the most common real-world stalkerware sign, per the FTC.
8. An unknown tracker alert. “AirTag Found Moving With You” or a similar Android alert means a Bluetooth tracker is traveling with you.
9. Apps you didn’t install, or apps with no icon. Check the full app list in Settings, not just the home screen.
10. Messages or calls you didn’t send. Friends receive links “from you”, or your call log shows numbers you never dialed.
11. Unexplained data use. One app using far more mobile data than its purpose explains, especially in the background.
12. Battery drain and heat with no explanation. Only meaningful if it’s new, persistent, and Battery settings point to an app you don’t recognize.

Signs that usually aren’t hacking (myths)

A lot of online advice treats ordinary phone behavior as proof of spyware. These are the usual false alarms.

So, phone battery draining fast — hacked or not? Usually not. Open Settings › Battery and look at which apps are using power. If the top consumer is an app you know, you have your answer.

Can someone hack my phone by calling me?

For almost everyone, no. Answering a call from an unknown number doesn’t install anything. The real risk on calls is social engineering: a caller pretending to be your bank, carrier or “Apple Support” who talks you into reading out a verification code, installing a remote-access app or approving a sign-in.

Genuine zero-click attacks through calling apps have happened. In May 2019 WhatsApp patched a flaw that let spyware be installed through a missed voice call, which was linked to NSO Group’s Pegasus. Those exploits are rare, expensive and fixed by updates, which is why keeping your phone and apps updated is the single most effective defense. If you are a likely target of that class of spyware, read the Lockdown Mode and Advanced Protection sections below.

How to check for spyware on iPhone

iPhones are hard to infect with conventional malware because apps come from the App Store and run in a sandbox. Signs of spyware on iPhone therefore usually point to a compromised Apple Account, a configuration profile, or (for a small group) mercenary spyware. Run these checks in order.

1. Look for an unknown MDM profile on iPhone

Go to Settings › General › VPN & Device Management. On a personal phone this section is often empty or missing. If you see a configuration profile or a “Mobile Device Management” entry you don’t recognize, tap it to see which organization installed it and what it can do. A management profile can route your traffic through a VPN, install certificates and push apps.

Remove a profile you didn’t install by tapping it and choosing Remove Profile. If the phone is supervised by an organization through Apple Business Manager, you may not be able to remove it — that is expected on a company phone, but a red flag on one you bought as personal. Learn the difference in our MDM lock guide, and if you bought the phone used, run an MDM status check on the serial number to see whether it’s enrolled with an organization.

2. Run Safety Check

Safety Check, available on iOS 16 and later, lives in Settings › Privacy & Security › Safety Check. It has two modes. Manage Sharing & Access lets you review which people and apps can see your location, photos and other data, which devices are signed in to your Apple Account, and which phone numbers can receive verification codes. Emergency Reset immediately stops sharing with all people and apps and walks you through resetting account security.

3. Check the devices on your Apple Account

Open Settings › [your name] and scroll to the device list. Every device signed in with your Apple Account appears here. Tap one you don’t recognize and choose Remove from Account, then change your Apple Account password. Also check Settings › [your name] › Sign-In & Security for trusted phone numbers you didn’t add.

4. Review apps and permissions

Go to Settings › Privacy & Security and check Location Services, Camera, Microphone and Local Network for apps you don’t recognize. Then scroll to the bottom of Settings › Apps to see every installed app. Delete anything you didn’t install.

5. Watch for Apple threat notifications

Apple sends threat notifications when it detects activity consistent with mercenary spyware. According to Apple, they appear as an alert on the Lock Screen and in Settings, by email to your Apple Account address, and as a banner when you sign in at account.apple.com. Apple says these notifications never ask you to click links, open files, install apps or profiles, or give your password — so a “threat notification” that does any of those is itself a phishing attempt. Verify by signing in to account.apple.com directly.

6. Turn on iPhone Lockdown Mode if you could be targeted

Lockdown Mode (Settings › Privacy & Security › Lockdown Mode) is an extreme, optional protection. It blocks most message attachments other than images and disables link previews, rejects FaceTime calls from people you haven’t contacted, disables some web technologies such as JIT JavaScript compilation, blocks wired connections while the phone is locked, and prevents installing configuration profiles or enrolling in MDM. Apple recommends it to anyone who receives a threat notification. Newer iPhones also add hardware defenses — see our piece on iPhone 17 Memory Integrity Enforcement.

How to remove spyware from Android

Android lets you install apps from outside Google Play, so malicious apps are a bigger real-world risk than on iPhone. Google said that in 2025 Play Protect identified more than 27 million new malicious apps from outside Google Play. Here is how to find and remove them.

1. Run a Play Protect scan

Open the Play Store, tap your profile picture › Play Protect › Scan. Make sure “Scan apps with Play Protect” is on in the settings gear. Play Protect also checks apps you sideload. If it flags something, follow its prompt to uninstall.

2. Check device admin apps

Device administrator rights let an app lock the screen, wipe data or prevent its own uninstall. The menu location varies by brand: on Pixel it’s under Settings › Security & privacy › More security & privacy › Device admin apps; on Samsung it’s under Settings › Security and privacy › Other security settings › Device admin apps. Or simply search Settings for “device admin”. Only apps such as Find My Device, a work profile or your employer’s management app should be listed. Turn off anything else, then uninstall it.

3. Look for accessibility abuse

Banking trojans and stalkerware love Android’s accessibility service, because it can read everything on screen and perform taps for you. Open Settings › Accessibility and look at Downloaded apps or Installed services. A flashlight, “system update”, PDF reader or game with accessibility access is a classic malware pattern. Turn it off and uninstall the app.

4. Check special app access and unknown sources

Search Settings for “Install unknown apps” and revoke the permission from browsers, messaging apps and file managers you don’t use for installs. Also check “Special app access” for Notification access, Display over other apps and Usage access. Spyware often grabs these to read notifications (including 2FA codes) and draw fake login screens.

5. If an app won’t uninstall, use Safe Mode

Restart into Safe Mode (on most phones, press and hold Power, then long-press Power off or Restart). Third-party apps don’t run in Safe Mode, so you can remove their admin rights and uninstall them. Restart normally afterward.

6. Consider Android Advanced Protection

Android Advanced Protection (Settings › Security & privacy › Advanced Protection) is Google’s strongest setting, designed for people at high risk. Per Google’s help page, it keeps Play Protect permanently on, blocks installs from unknown sources, restricts accessibility tools for non-accessibility apps, turns on Theft Detection Lock, Offline Device Lock, USB protection and a 72-hour inactivity reboot, blocks 2G connections, enables scam detection in Messages and Phone, and forces HTTPS and Safe Browsing in Chrome. It can also keep encrypted Intrusion Logging so investigators can review what happened later. Availability and features depend on your phone and Android version.

Is someone tracking my phone? Stalkerware and unknown trackers

Stalkerware is monitoring software that someone installs on your phone without consent to read messages, track location or record calls. It usually requires physical access to your unlocked phone, which is why it’s most often linked to partners, ex-partners or family members.

How to check for stalkerware

• On Android, the device admin, accessibility and notification-access checks above catch most commercial stalkerware.
• On iPhone, stalkerware more often works by logging in to your iCloud backup with your password, or by a shared Apple Account. Safety Check and the device list catch both.
• Check location sharing in Find My (People tab) and in Google Maps › Location sharing.
• Check for linked devices in WhatsApp, Signal, Telegram and Messenger (each has a “Linked devices” or “Active sessions” menu). A forgotten web session lets someone read your chats in real time.

Unknown tracker alerts

Since May 2024, Apple and Google support a cross-platform standard called Detecting Unwanted Location Trackers. iPhones on iOS 17.5 or later and Android phones on Android 6.0 or later can warn you with an “[Item] Found Moving With You” alert when an unknown AirTag or compatible tracker (Chipolo, eufy, Jio, Motorola, Pebblebee and others) travels with you. The alert lets you play a sound to find the tracker and shows how to disable it. If you feel unsafe, contact law enforcement before disabling it — the tracker’s serial number can help identify the owner.

What to do if your phone is hacked: step-by-step

Work through these steps in order. The early steps stop ongoing access; the later ones lock the door behind you.

1. Disconnect and note what you see. Screenshot suspicious profiles, apps, alerts and account sign-ins before deleting anything, especially if you might report it.
2. Update everything. Install the latest iOS or Android version and update all apps. Many exploits stop working once patched.
3. Remove unknown profiles, apps and permissions. Delete profiles in VPN & Device Management, revoke device-admin and accessibility rights, then uninstall suspicious apps.
4. Change passwords from a clean device. Start with your email, then Apple Account or Google Account, then banking and social media. Use a different, unique password for each.
5. Turn on two-factor authentication. Prefer passkeys or an authenticator app over SMS codes, and remove unknown trusted numbers and devices. Our guide to securing your Apple ID and Google account covers each setting.
6. Sign out of other sessions. Remove unknown devices from your Apple and Google accounts and log out linked devices in messaging apps.
7. Lock your SIM and carrier account. Set a SIM PIN (iPhone: Settings › Cellular › SIM PIN; Android: search Settings for “SIM lock”), and turn on your carrier’s port-out and SIM-change protection, such as Verizon Number Lock, T-Mobile SIM Protection or AT&T Wireless Account Lock. See how SIM swap fraud works.
8. Factory reset if signs persist. Back up photos and contacts, erase the phone, then set it up as new and reinstall apps from the official store — don’t restore a full backup that might bring the problem back. Our factory reset guide explains how.
9. Enable the strongest protection you can live with. iPhone Lockdown Mode or Android Advanced Protection if you’re at elevated risk; otherwise Stolen Device Protection (iPhone) or Theft Protection (Android).

When to get professional help

Get expert help if you received an Apple threat notification or a Google government-backed attack warning, if you’re a journalist, activist, lawyer, politician or executive, or if the steps above didn’t stop the problem. Access Now’s Digital Security Helpline offers free help to civil society — journalists, activists and human rights defenders — 24 hours a day, seven days a week, and Apple points notified users to it. Amnesty International’s Security Lab also investigates mercenary spyware cases.

For financial fraud, contact your bank and report it to the FTC at reportfraud.ftc.gov or the FBI at ic3.gov. For stalking or threats, contact local police. For business devices, talk to your IT department before wiping anything — they may need logs.

Bought the phone used? Check its history too

A secondhand phone can come with problems that look like hacking: a leftover corporate management profile, a previous owner’s account still attached, or a blacklisted IMEI that suddenly loses service. Before you blame malware, confirm the phone’s status with an MDM check, an All-in-one Basic Info report (model and Find My status) and a GSMA blacklist check.

The short version: check for profiles, admin apps, account sign-ins and official alerts; ignore the myths; update, clean up and lock down your accounts; and reset if anything remains. If you might be a high-value target, turn on Lockdown Mode or Advanced Protection and ask experts for help.