How to Know If Your Phone Is Hacked and What to Do

Symptom is not evidence

Almost every list of hacked-phone warning signs is a list of ordinary phone behavior. Batteries lose capacity, background apps wake up, carriers have bad days, and software updates make old hardware feel slower. None of that is a diagnosis.

What counts as evidence is different in kind. Evidence is something that happened in an account rather than something you felt about the hardware: a sign-in from a place you have never been, a message you did not send, a device you do not own listed on your account, a configuration profile you did not install. Those things have a record attached.

The reason this matters is cost. Chasing a symptom usually ends with a factory reset that fixes nothing, because the real problem was a password that leaked two years ago. Looking for evidence tells you which of those two situations you are in, and they need opposite responses.

The signs that prove very little

These are the complaints that bring most people to this page, and on their own each has a boring explanation that is far more likely than an intruder.

The battery drains faster than it used to. Lithium batteries lose capacity with age, and both iPhone and Android show battery health and a per-app breakdown of usage in settings. Check which app is responsible before assuming anything.

The phone runs hot. Charging, navigation, video, direct sun, and a heavy update all do this.

It feels slow, or apps crash. Storage nearly full, a new operating system on old hardware, or a single misbehaving app.

Pop-up ads appear. Usually an ad-heavy app or a browser page, not a system compromise. Worth removing anyway.

Data usage jumped. Check the per-app figures in settings. Automatic backups, video, and a phone that fell off Wi-Fi explain most spikes.

You got a strange text or a one-off spam call. Phone numbers circulate constantly. The FTC explains how to recognize and report spam texts, and receiving one says nothing about your device.

Any of these can accompany a real problem. None of them, alone, is one.

The signs worth acting on

These leave a record somewhere, which is what makes them worth acting on. Any single one justifies a full check of your accounts today.

The phone loses all service for no reason, or the carrier tells you your SIM was activated on a new device. That is the opening move of a SIM swap, and it is the one item on this page where the first hour matters most.

Messages or emails you did not send appear in your sent folder, or contacts reply to something you never wrote.

Sign-in alerts, password reset emails, or verification codes arrive when you were not signing in anywhere. Somebody is at the door with your password.

A device you do not recognize shows up in your account’s device list, or a session in a country you have never visited.

An app, profile, or administrator you did not install. On iPhone this shows up as a configuration profile or device management entry. On Android it shows up as an app with device administrator rights or accessibility permission it has no reason to need.

Settings changed by themselves: a new mail forwarding rule, a new recovery phone number or email, a new trusted device, a payment method you did not add.

An official threat notification. Apple sends threat notifications to users it believes were individually targeted by mercenary spyware. Apple describes these as high-confidence alerts. They are rare, and they are evidence.

How to check an iPhone

Four screens cover most of what a non-specialist can verify, and none of them need an extra app installed. Work through them in order and write down anything you do not recognize.

1. Device management. Settings, then General, then VPN and Device Management. A personal phone should normally show nothing here except a work profile you knowingly enrolled. A profile you do not recognize is a real finding.
2. Your Apple Account device list. Settings, then your name, then scroll. Apple documents how to review the devices signed in to your Apple Account, including from the web if you have no Apple device to hand. Remove anything unfamiliar.
3. Safety Check. Settings, then Privacy and Security, then Safety Check. Apple’s Safety Check guide explains how to review what you are sharing with people and which apps have access to your information, and how to stop it.
4. App permissions and unfamiliar apps. Settings, then Privacy and Security, and look through location, microphone, camera, photos, and contacts. Then scroll the app list itself for something you do not remember installing.

Apple also offers Lockdown Mode, an extreme setting that limits features to reduce the attack surface. It is intended for people who believe they are specifically targeted, and it will break ordinary things, so it is not a general recommendation.

How to check an Android phone

The equivalent checks on Android live in four places, and the exact menu names vary between manufacturers. The words to look for are the same.

1. Run Play Protect. Open the Play Store, tap your profile picture, then Play Protect, then Scan. Google documents how Play Protect checks apps for harmful behavior, including apps installed from outside the store.
2. Review app permissions. Google documents how to change app permissions. Pay closest attention to accessibility services, notification access, and apps allowed to display over others, because those are the permissions that let one app read and control another.
3. Check device administrator apps. Usually under Settings, Security, then Device admin apps. An entry you did not add is a real finding, and it will often block its own uninstall until you remove the admin right first.
4. Review your Google Account devices. Google documents how to see devices with account access and sign out of the ones you do not recognize.

Also scroll the full app list, including apps with generic names. Software meant to sit unnoticed does not advertise itself, and a plain name like a system utility is the usual disguise.

The order of the cleanup

Order matters more than speed here. Changing passwords from a device you do not trust simply gives the new passwords away, so the sequence starts by getting to safe ground.

1. If you lost mobile service or got a SIM notice, call your carrier first, from another phone. Nothing else works while your number is on someone else’s device. The FCC’s guide to cell phone fraud covers SIM swap and port-out fraud.
2. Move to a device you trust for the password changes. A partner’s laptop or a family computer is fine. If you have no second device, secure the accounts anyway and repeat the changes after the phone is clean.
3. Change the email password first, then the phone carrier account, then banking and payment, then everything else. Email is the reset path for the rest.
4. Sign out of all other sessions in each account’s security settings, so an open session cannot continue without a new sign-in.
5. Check the recovery settings you just walked past: recovery email, recovery phone, trusted devices, and mail forwarding rules. These are what gets changed so the intruder can come back.
6. Turn on the strongest second factor each account offers. See the guide to two-factor authentication methods for which to choose.
7. Remove what you found on the phone, then install every pending operating system and app update. CISA notes that updates usually contain fixes for problems already being exploited.
8. Tell your bank if any financial account was reachable, and watch statements for the following weeks.

When a factory reset makes sense, and what it does not fix

A factory reset is the right move when you found something on the device and cannot remove it, or when the evidence points at the phone rather than at an account. It is the wrong first move in almost every other case.

It does not fix a leaked password, because the password lives on the company’s server, not on your phone. It does not remove someone from your accounts. And restoring a backup made while the problem was present can carry the problem straight back, so set the phone up fresh and reinstall apps by hand rather than restoring everything at once.

Before resetting, write down what you found. If you later report the incident, that note is the only record you will have, since the reset erases the rest.

If the person with access is close to you

Monitoring software installed by a partner, relative, or ex is a different situation from a distant criminal, and the usual advice can make it worse. Someone who is watching the phone may see the settings you open and the apps you remove.

If there is any risk to your safety, get advice before you change anything on the device. The Office on Women’s Health lists the National Domestic Violence Hotline at 800-799-SAFE (7233), with chat and email options, and Apple publishes a Personal Safety User Guide written for exactly this situation, including how to review sharing quietly.

Use a device the other person cannot reach when you start changing passwords, and expect that accounts, location sharing, and family plans may all need to be untangled separately. This is not something to solve in one evening on the phone in question.

Where to report it

Report it even when nothing was stolen, because reports are how patterns get seen. None of these agencies will recover a device or a password for you, and none of them guarantee money back.

File with the FBI’s Internet Crime Complaint Center for computer and account intrusions. Report fraud and scam contact to the FTC at ReportFraud.ftc.gov. If your personal information was used to open accounts or file anything in your name, the FTC’s free IdentityTheft.gov walks through a recovery plan.

Keep the paper trail as you go: dates, what you saw, screenshots taken from a second device, case numbers, and the names of anyone you spoke to. Banks and platforms ask for specifics later, and memory is a poor substitute.

Phone security FAQ