Signs Your PIN or Password Has Been Altered
It's unsettling if your usual PIN or password suddenly stops working. Here are some common indicators that your device's security might have been changed without your consent.
- You cannot unlock your device using your usual PIN, pattern, or password.
- You receive notifications on your lock screen that seem unusual or out of place.
- Apps appear to be missing or new, unfamiliar apps have been installed.
- Your device 's battery drains much faster than usual, even without heavy use.
- Unexpected data usage spikes occur, suggesting background activity you didn't initiate.
Important
Do not attempt to factory reset your device at this stage, as this may erase valuable forensic data.
Check Locked Device Notifications and System Messages
Even if you can't unlock your phone, the lock screen can often provide clues. Look for anything out of the ordinary.
- Observe the lock screen carefully for any unusual notifications or banners that might indicate a system change or suspicious app activity.
- Try to trigger the 'Emergency call' option (if available) to see if it allows access to any network or system messages.
- On some Samsung devices, a subtle change in the lock screen wallpaper or font might be an early indicator.
Good to know
Some malware can mimic system notifications to trick you, so be cautious about interacting with any alerts directly.
Verify Google Account Activity (from another device)
If your phone's security has been compromised, your linked Google account might also show signs of unusual activity. You'll need another device for this step.
- On a trusted computer or another mobile device, go to your Google Account security page at
myaccount.google.com/security. - Look for the 'Recent security activity' section and review any unfamiliar sign-ins, especially from new devices or locations.
- Check the 'Your devices' section to see if any unknown devices are logged into your Google account.
- Review 'Third-party apps with account access' and revoke access for any apps you don't recognise.
Tip
Enabling 2-Step Verification on your Google Account is a crucial step to protect it from unauthorised access.
Examine App Permissions and Device Administrators (if accessible)
If you manage to briefly access your device, or if the attacker has left specific settings unprotected, you can check for changes to app permissions.
- Navigate to
Settings→Apps→See all apps. Scrutinise recently installed or updated apps for anything suspicious. - Review the permissions for any unknown apps by tapping on them and selecting
Permissions. Look for apps with excessive or unusual permissions. - Go to
Settings→Security & privacy(orBiometrics and securityon Samsung) →More security settings→Device admin apps. Confirm that only legitimate apps like 'Find My Device' are listed. - On Samsung devices, this path might be
Settings→Biometrics and security→Other security settings→Device admin apps.
Good to know
Malicious apps often try to gain 'Device admin' privileges, making them very difficult to uninstall.
Was this guide helpful?
Know someone who needs this? Send them the guide.
JD
Written by
Jordan DicksonFounder, CyberSecurityGuides
Founder of CyberSecurityGuides, writing practical, jargon-free guides that help everyday people recover from and protect against online attacks.
Reviewed by CSG Security Engineers