How to Know If Your Phone Is Hacked: 10 Signs + Fix

Warning signs, a 5-minute self-check, and exactly what to do if your phone has been compromised. No technical knowledge needed.

If your phone has been acting strange — battery draining fast, pop-ups appearing, calls or texts you didn't send — you're right to be suspicious. Most 'hacked phone' situations aren't dramatic Hollywood-style break-ins. They're usually spyware, a hijacked account, or a malicious app you installed without realising. The good news: almost every case can be fixed in under an hour if you act methodically.

Good to know

🎯 Goal: By the end of this guide you'll know whether your phone is actually compromised, and if it is, exactly which steps to take — in the right order — to lock things down.

1. The 10 warning signs

No single sign means you've definitely been hacked. But if three or more of these are happening together, take it seriously.

Battery drains noticeably faster than a week ago, even with the same usage
The phone runs hot when you're not using it
Mobile data usage has jumped without you streaming or downloading more
Apps you don't remember installing have appeared on your home screen
Pop-ups, browser redirects, or full-screen ads when you open the browser
Friends mention messages or calls from you that you didn't send
Your email or social accounts log you out unexpectedly, or send password reset emails you didn't request
Settings change on their own (Bluetooth turns on, location turns on, new profiles appear)
The phone reboots, freezes, or crashes apps far more than usual
You hear background noises, echoes, or clicks during phone calls

2. The 5-minute self-check

Before assuming the worst, run through this short checklist. It catches the vast majority of real problems.

Review installed apps

iPhone: Settings → General → iPhone Storage. Android: Settings → Apps → See all apps. Sort by name and look for anything you don't recognise — particularly anything called 'System Service', 'Device Health', 'Update Helper', or generic-sounding names. Stalkerware often hides under boring labels.

Check which apps have powerful permissions

iPhone: Settings → Privacy & Security → check Microphone, Camera, Location, and Accessibility. Android: Settings → Privacy → Permission manager. Anything with Accessibility access on Android can read your screen and type for you — only allow it for apps you explicitly trust (a password manager, for example).

Look for unknown profiles or device admins

iPhone: Settings → General → VPN & Device Management. If you see a profile you didn't install (school or work-issued is fine; anything else isn't), that profile can monitor traffic and install apps silently. Android: Settings → Security → Device admin apps. Same rule — remove anything you don't recognise.

Check for unknown logins on your main accounts

Open Gmail/Google → Manage your Google Account → Security → 'Your devices'. Apple ID → Settings → tap your name → scroll to the device list. Facebook/Instagram/WhatsApp all have a similar 'Active sessions' or 'Where you're logged in' page. If you see a device or location you don't recognise, sign it out and change your password immediately.

Run a malware scan (Android only)

Android: Open the Play Store → tap your profile picture → Play Protect → Scan. iOS doesn't have third-party antivirus in the traditional sense — Apple controls the app sandbox, so if your iPhone is jailbroken or you've installed a configuration profile, that's the actual risk to investigate.

3. What to do if you find something suspicious

Important

⚠️ Don't panic and don't factory-reset yet — you'll lose evidence and may lock yourself out of accounts. Work through these steps in order.

Disconnect from the internet. Turn on Airplane Mode. This stops any active data exfiltration while you work.
From a different, trusted device (a family member's laptop is fine), change the password on your primary email account first. Email is the master key — if someone controls your inbox, they can reset every other account.
Sign out of all sessions on that email account, then sign back in only on your devices.
Repeat for your most important accounts in this order: Apple ID / Google Account → banking → primary social media.
Back on your phone, uninstall any suspicious apps you found in the self-check. Remove any unknown profiles or device admins.
If pop-ups, redirects, or strange behaviour persist, factory reset the phone. Set it up as new — do not restore from a backup made after the suspicious activity started, or you may reinstall the problem.

4. When it's probably not a hack

A surprising amount of 'my phone is hacked' panic turns out to be normal phone behaviour.

If your only symptom is a slower battery on a 2-year-old phone — that's the battery aging
If ads appeared in one specific free app — that's the app's monetisation, not malware
If a single contact says they got a weird message from your number — it might be SMS spoofing; they're not really getting it from you

Real compromises usually show up as a cluster of symptoms across multiple categories — performance and accounts and unfamiliar apps and strange messages — not just one of those things in isolation.

5. How phones actually get compromised

Understanding the real attack paths makes it much easier to spot and prevent. In our experience helping people through recovery, these four causes account for the vast majority of cases:

Reused passwords. An old password from a hacked website (LinkedIn, Adobe, Dropbox) gets tried against your email. If it matches, they're in. Symptoms look identical to a 'hacked phone'.
Stalkerware installed by someone with physical access. Almost always a current or former partner. Requires a few minutes alone with the unlocked phone. Change your phone passcode now if you're worried.
Malicious profiles or sideloaded apps. Tapping 'Install' on a profile from a sketchy website, or sideloading an APK from outside the Play Store. Both grant huge permissions in one tap.
Phishing that captured a 2FA code. You entered your password and code on a fake login page. The attacker forwarded both to the real site in real time.

6. Lock things down going forward

Once you've cleaned up, three changes prevent a repeat:

Use a password manager. Every account gets a unique, generated password. If one site leaks, the damage stops there.
Turn on two-factor authentication on email, social media, and banking — using an authenticator app, not SMS, where possible.
Keep your phone's OS up to date. Most spyware exploits known bugs that have already been patched.

Good to know

🛟 Need help right now? If you're confident your phone has been compromised, our free Recovery Tool walks you through every account and device that needs attention, in the right order, with platform-specific instructions. Takes about 10 minutes and gives you a printable checklist.

Was this guide helpful?

Know someone who needs this? Send them the guide.

Written by

Jordan Dickson

Founder, CyberSecurityGuides

Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.

Reviewed by CSG Security Engineers

How to know if your phone is hacked (and what to do next)