How to Tell If Your Phone Is Hacked: Signs and Fixes

Your phone may be hacked if you see apps you didn’t install, unfamiliar device-management profiles, accounts signing in from places you’ve never been, or messages sent that you didn’t write. Battery drain and heat on their own are usually innocent. If you’re worried, update the phone, remove unknown apps and profiles, run Safety Check (iPhone) or Play Protect (Android), and change the passwords for your main accounts from a different device.

Full-blown remote hacking of a modern, updated phone is rare and expensive. Much more common are malicious apps, phishing that steals account passwords, and stalkerware installed by someone who had the phone in their hands.

Warning signs that are worth checking

Apps you don’t recognize, especially ones with generic names like “System Service” or “Sync”.
Configuration profiles or device admin apps you didn’t add (explained below).
Account alerts: “new sign-in” emails, password-reset messages you didn’t request, or friends receiving odd messages from you.
Pop-ups and redirects outside the browser, or ads appearing on the home screen.
Unexplained data use by a specific app, visible in your cellular settings.
Settings that changed by themselves, such as a new VPN, a different default browser or disabled security features.
Calls or texts on your bill to premium or international numbers you didn’t contact.

Signs that usually aren’t hacking

Faster battery drain, a warm phone and sluggishness are more often caused by an aging battery, a recent update still indexing in the background, or one badly behaved app. Check the battery screen to see which app is responsible before assuming the worst.

How to check an iPhone

Update iOS. Go to Settings > General > Software Update and install anything available. Updates close the security holes that spyware relies on.
Look for profiles. Go to Settings > General > VPN & Device Management. If you see a profile you don’t recognize and the phone isn’t managed by your employer or school, tap it and choose Remove Management or Remove Profile.
Review apps and battery use. Check Settings > Battery for apps with unusually high activity, and scroll through your App Library for anything unfamiliar.
Run Safety Check. Go to Settings > Privacy & Security > Safety Check. Manage Sharing & Access shows who and which apps can see your location, photos and other data, and lets you revoke access. Emergency Reset immediately stops all sharing, signs out other devices and helps you change your Apple Account password.
Check your Apple Account devices. Go to Settings > [your name] and scroll to the device list. Remove any device you don’t own.

When to use Lockdown Mode

Lockdown Mode is an extreme protection mode for people who may be targeted by sophisticated spyware, such as journalists, activists or officials. It blocks most message attachments, some web technologies, unknown FaceTime calls and wired connections to computers while the phone is locked. Turn it on at Settings > Privacy & Security > Lockdown Mode; the phone restarts. Most people don’t need it, and it will make some apps and websites behave differently. Apple explains the details on its Lockdown Mode support page.

Apple also sends threat notifications by email and iMessage, and displays them at the top of the Apple Account page, if it detects that you may have been targeted by state-sponsored spyware. Such a notice is rare and should be taken seriously.

How to check an Android phone

Menu names vary between Pixel, Samsung and other brands, so use the search bar at the top of Settings if a path doesn’t match exactly.

Update everything. Go to Settings > System > Software updates (Samsung: Settings > Software update), and also check Settings > Security & privacy for a Google Play system update.
Scan with Play Protect. Open the Play Store, tap your profile picture, then Play Protect, and tap Scan. Make sure scanning is on via the gear icon.
Check device admin apps. Search Settings for Device admin apps. Only things like Find My Device or a work profile should be listed. Turn off anything else, then uninstall it.
Check accessibility services. Go to Settings > Accessibility and look at installed services. Stalkerware often abuses accessibility access to read your screen.
Review app permissions. Go to Settings > Security & privacy > Privacy > Permission manager and check which apps have location, microphone, camera and SMS access.
Look for sideloaded apps. Search Settings for Install unknown apps and turn the permission off for every app that doesn’t need it.

Advanced Protection on Android 16 and later

Phones running Android 16 or later can turn on Advanced Protection, Google’s equivalent of Lockdown Mode. Find it under Settings > Security & privacy > Other settings > Advanced Protection (some phones place it elsewhere; search for it). It locks in Play Protect, blocks sideloading and restricts risky features like 2G connections. Like Lockdown Mode, it’s aimed at high-risk users.

What to do if you think your phone is compromised

Use a different, trusted device to change the passwords for your email, Apple or Google account, bank and social media. Start with email.
Turn on two-factor authentication for those accounts, preferably with passkeys.
Sign out unknown sessions. Google, Apple, Microsoft, Facebook, WhatsApp and most other services list active devices; remove the ones you don’t recognize.
Remove suspicious apps and profiles using the steps above.
Call your carrier if you lost service unexpectedly or see unknown charges, and ask for a SIM lock or port-out protection to prevent a SIM swap.
Factory reset as a last resort. Back up photos and contacts first, but don’t restore apps from a backup made after you suspect the problem began. Reinstall apps manually from the official store.

Safety warning: if you suspect a partner, family member or someone close to you installed stalkerware, removing it may alert them. If you’re worried about your safety, contact a domestic violence hotline or local authorities for help planning next steps before you change anything.

How to prevent it happening again

Install apps only from the App Store or Google Play. Even there, it pays to check whether an app is safe.
Keep automatic updates on.
Use a strong screen-lock passcode and don’t share it.
Don’t tap links in unexpected texts about deliveries, tolls or bank problems.
Restart your phone regularly; it clears some types of memory-only malware.

Bottom line

Most “is my phone hacked?” worries come from battery or app issues, not spyware. Do the quick checks: update, look for unknown apps, profiles and admin apps, run Safety Check or Play Protect, and review account sign-ins. If something is wrong, secure your accounts from another device first, then clean or reset the phone.

FAQ

Can someone hack my phone just by calling or texting me?

It’s possible but rare and typically reserved for high-value targets using expensive spyware. Keeping your phone updated is the best defense; Lockdown Mode or Advanced Protection adds more for at-risk people.

Does a factory reset remove spyware?

A reset removes almost all app-based spyware. It won’t fix stolen account passwords, so change those too.

Do I need an antivirus app on my phone?

Most people don’t. iPhone apps are sandboxed, and Android already includes Play Protect. Be wary of “cleaner” or “security” apps that show alarming warnings to sell subscriptions.

Is a jailbroken or rooted phone more at risk?

Yes. Jailbreaking or rooting removes core protections and makes it far easier for malicious apps to take control.