Phone hacked? Here's exactly what to do.
Spot the warning signs, then work through the first response steps below to lock attackers out immediately — followed by a personalised recovery plan for your phone.
Warning signs
8 signs your phone has been hacked
One of these on its own can be a glitch. Two or more together is a strong indicator that something is wrong — and worth investigating today.
Battery drains unusually fast
Spyware and crypto-miners run constantly in the background, killing battery in hours instead of a full day.
Phone runs hot when idle
If your phone is warm in your pocket without being used, something is working hard behind the scenes.
Mobile data spikes for no reason
Hidden apps quietly upload your photos, messages, and location — usually showing up as a data spike.
Apps you don't recognise
New icons in your app drawer, or apps with generic names like 'System Service', are a major red flag.
Strange calls or texts you didn't send
Friends mention odd messages from you, or you see unknown numbers in your call log.
Pop-ups, redirects, and weird ads
Sudden pop-ups outside the browser, or your home screen redirecting you to ad sites, points to malware or adware.
Settings change on their own
Wi-Fi turns on by itself, accessibility permissions appear, or VPN profiles you didn't install show up.
You're locked out of your accounts
Password reset emails you didn't request, or a sudden inability to sign into Apple ID / Google account.
First response
The 4 steps to take in the next hour
Work through these in order. Each step closes a path the attacker is currently using to hold or extend their access.
Step 01
Disconnect from the network
Turn on Airplane Mode. This stops attackers from exfiltrating data while you secure the device.
Step 02
Change critical passwords from another device
Use a clean laptop or tablet to reset your email, Apple ID / Google account, and banking passwords first.
Step 03
Turn on two-factor authentication
Add an authenticator app (not SMS) to email and financial accounts before your phone goes back online.
Step 04
Build your recovery plan
Use the tool below to generate a step-by-step recovery plan tailored to your phone and situation.
Recovery plan
Pick your phone to start recovery
Tap your phone, pick the issues, and we'll show a tailored step-by-step recovery plan — assuming you no longer have access.
FAQ
Common questions about a hacked phone
Can someone hack my phone just by knowing my number?
Not directly. Knowing your number lets attackers send phishing texts, attempt SIM-swap fraud, or target you with spam — but they can't take over the phone from the number alone. The real risk is what you do with messages or links you receive. Never tap links from numbers you don't recognise.
Will a factory reset remove a hacker from my phone?
In most cases, yes. A full factory reset wipes installed apps, profiles, and configuration. The exceptions are rare nation-state-grade implants. After the reset, restore from a clean backup — not one taken while the phone may already have been compromised — and change every password.
How do I know if my iPhone or Android has spyware?
Look for unexplained battery drain, the phone running hot, mobile data spikes, unknown configuration profiles, and apps with vague names you don't remember installing. On iPhone use Settings → Privacy & Security → Safety Check. On Android boot into Safe Mode and check Device Admin and Accessibility settings.
What's the difference between a hacked phone and a hacked account?
A hacked account (email, Apple ID, Google, social media) means an attacker has your credentials. A hacked phone means malicious software is running on the device itself. They're often connected — a hacked phone usually leads to compromised accounts, and stolen account credentials can be used to remotely wipe or track your phone.
Should I call the police if my phone is hacked?
If money has been stolen, your identity has been used fraudulently, or you suspect stalkerware installed by someone who knows you, yes — file a report. In the US, use IC3.gov; in the UK, Action Fraud; in the EU, your national cybercrime unit. A police report is also required for most insurance and bank fraud claims.
How fast do I need to act?
The first hour matters most. Every minute a compromised phone stays online is more time for an attacker to drain accounts, harvest contacts, and pivot to your other devices. Get into Airplane Mode now and use a different device to start the recovery steps.
Phone security topics
Explore guides grouped by the phone security issues that matter most — from malware and stalkerware to SIM swaps and location tracking.
Go deeper