How to Know If Your Phone Is Hacked: 12 Signs and What to Do (2026)

How-toUpdated 25 Oct 2026

How do you know if your phone is hacked? Look for a cluster of signs rather than one: a battery that drains faster than usual, data use you can't explain, overheating, random restarts, apps you never installed, and messages or logins you didn't make. If several show up together, update the phone, run the built-in scanner, remove unknown apps and change your passwords from another device. Most of the fixes are free and built into Android and iPhone, and many of them sit next to the settings in our iPhone setup guide.

Not every attack is technical: many start with a message built to win your trust, as our story about a Brazilian man who sold everything for an AI-generated online love shows.

Key facts at a glance

Most common signs: Fast battery drain, extra data use, overheating, unexpected restarts (FTC)
Account red flags: Changed security settings, unknown logins, messages you didn't send (NCSC)
Built-in tools: Google Play Protect (Android); Safety Check and Lockdown Mode (iPhone)
Cost: Free: every step in this guide uses tools already on the phone
Last resort: Factory reset, then reinstall apps from the store, not from an old backup (FTC)

Key points

The FTC lists faster battery drain, more data use, overheating and random restarts as signs of spyware.
Spying apps can hide in settings under fake names like System Service.
Google Play Protect is on by default and scans apps from outside the Play Store too.
Safety Check on iPhone with iOS 16 or later shows who and what can access your data.
After a factory reset, reinstall apps from the store, not from an old backup.
CISA advises moving away from SMS codes and adding a PIN to your mobile carrier account.

12 signs your phone may be hacked

No single symptom proves anything. What matters is a change from normal, especially several at once. The signs below come from the US Federal Trade Commission (FTC) and the UK's National Cyber Security Centre (NCSC).

Signs in how the phone behaves

The battery drains faster than usual. Spyware that tracks your location or records audio keeps working in the background, and that costs power.
You use more mobile data than you expect. Stolen messages and photos have to be uploaded somewhere, so compare data use per app with a normal month.
The phone overheats when you are not using it. Warm while charging or gaming is normal; hot while idle in your pocket is not.
It turns off and on, freezes or slows down. The FTC lists restarts, slowdowns, freezes and crashes; Google notes a faulty app can cause the same, which the safe-mode test below helps rule out.

Signs in apps, ads and settings

Pop-up ads appear everywhere, or your browser redirects you. The FTC lists a changed home page, unwanted redirects and lots of pop-ups, including ads on sites that never show them, as malware symptoms.
There are apps you don't remember installing. According to the FTC, some spying apps hide in the phone's settings under harmless-sounding names such as "System Service", so read the full app list, not just your home screen.
The phone has been rooted or jailbroken without your knowledge. Some stalkerware can only be installed after someone removes the phone's built-in security protections. The FTC points to the Safety Net Project's guide for checking this.
An unknown configuration or management profile is installed (iPhone). Apple's Personal Safety guide includes a step to review and delete configuration profiles, and Apple says Lockdown Mode blocks new profiles precisely to stop attackers installing malicious ones.

Signs in your accounts and your life

Messages or posts you didn't write. The FTC and NCSC both list emails, posts or notifications you don't recognise as a warning sign.
Changed security settings or logins you can't explain. The NCSC tells people to watch for being locked out, security settings that changed, and logins from strange places or at unusual times.
Purchases or money transfers you didn't make. Unauthorised payments are on the NCSC's list, so check banking apps and app store receipts.
Someone knows things they shouldn't. If a partner or ex always seems to know where you are, who you text or what you said in a private conversation, the FTC says to treat that as a possible sign of stalkerware.

How to check your phone, step by step

These checks change nothing you can't undo, so do them before reaching for a factory reset.

On Android

Open the Google Play Store, tap your profile icon and open Play Protect to see its latest results and scan again. Google says Play Protect is on by default, checks apps before you download them, scans the device for harmful apps from other sources and can disable or remove them.
In the same menu, open Play Protect settings and make sure Scan apps with Play Protect is switched on. Under Settings > About in the Play Store you can confirm the phone is Play Protect certified.
If the phone keeps restarting, freezing or crashing, restart it in safe mode (the method differs by manufacturer). If the problem disappears, Google says an app is the likely cause: remove recent apps one by one, restarting after each.
In Settings > Apps, review the full list for vague system-style names you don't recognise.

On iPhone

Update to the latest iOS in Settings > General > Software Update.
Open Settings > Privacy & Security > Safety Check (iOS 16 or later, with two-factor authentication on your Apple Account). Use Manage Sharing & Access to review which people and apps can see your location and data, which devices are signed in to your Apple Account, and which phone numbers can verify your identity.
If you need to cut everyone off at once, Safety Check's Emergency Reset stops sharing with all people and apps and walks you through a new Apple Account password.
Under Privacy & Security, check which apps have access to your location, camera and microphone, as CISA recommends, and revoke anything that doesn't need it.

On your accounts (any phone)

The NCSC warns that criminals commonly set up email forwarding rules so they receive a copy of every message, including password-reset emails. Delete any filter or forwarding address you didn't create. Then look at the list of devices signed in to your Google or Apple account. In messaging apps such as WhatsApp and Signal, CISA advises checking the linked devices section and removing any device you don't recognise straight away.

What to do if your phone is hacked

Work through these steps in order: changing a password on a phone that is still infected may hand the new password to the attacker.

Stop signing in to sensitive accounts such as banking and shopping on that phone, as the FTC advises, until it is clean.
Update and scan. Install the latest system and app updates, then run Play Protect or a reputable security app and remove what it flags. Updates matter because they close the holes attackers use, a point we covered in our PHP2Shell patching explainer.
Change passwords from a different, trusted device. Start with your email, then any account that shared the same password; the NCSC notes that criminals try a stolen password on other accounts.
Log out every other session. After changing passwords, sign out all devices and apps so anyone still logged in has to enter the new password.
Turn on stronger sign-in. The NCSC recommends 2-step verification. CISA goes further: use passkeys or a security key where possible, and move away from SMS codes, which are not encrypted.
Warn your contacts and watch your money. Tell friends to ignore odd messages sent from your accounts, check bank statements, and report fraud: in the US at ReportFraud.ftc.gov (or IdentityTheft.gov if your identity was stolen), in the UK to Report Fraud.
Factory reset if the problem persists. Back up photos and documents first. On Android, make sure you know the Google Account password on the phone, and Google suggests waiting 24 hours after a password change before resetting. Afterwards, the FTC warns, don't restore apps from the old backup; download them again from the app store.

If you think someone close to you is spying

Stalkerware is different because the attacker may be a partner or ex. The FTC warns that removing it can tip them off and escalate abuse, so talk first to a domestic violence advocate from a friend's or pay-as-you-go phone, and document evidence before resetting anything. In the US, the National Domestic Violence Hotline is 1-800-799-7233. The safest option, the FTC adds, may be a new phone with accounts the abuser cannot access.

Targeted spyware: Lockdown Mode and Apple threat notifications

Apple says "mercenary spyware" attacks, such as NSO Group's Pegasus, cost millions of dollars and target a very small number of people, often journalists, activists, politicians and diplomats; most users will never face one. Since 2021 Apple has sent threat notifications several times a year, and it says it has now notified users in more than 150 countries.

A genuine alert appears on the iPhone Lock Screen and in Settings, by email, and as a banner at account.apple.com. Apple says these alerts never ask you to click a link, install an app or share a password or code, so any "warning" that does is itself a scam.

If you have good reason to think you are a target, Apple's Lockdown Mode (iOS 16 or later) is found under Settings > Privacy & Security > Lockdown Mode. It blocks most message attachment types, link previews, some web technologies, and FaceTime calls from people you haven't called in the past 30 days. Apple calls it an extreme protection that changes how the phone works, not a setting for everyday users.

How to stop it happening again

Do

Turn on automatic updates; CISA suggests checking weekly that the phone is up to date.
Use a screen lock of at least six digits, as the FTC recommends.
Add a PIN and extra sign-in protection to your mobile carrier account to make SIM swapping harder (CISA).
Review app permissions now and then, the same way you would check Google's ad settings in our Gmail ads privacy guide.

Don't

Install apps from ads, unfamiliar websites or links in messages.
Scan QR codes or group-invite links from unknown senders (CISA).
Call a phone number shown in a pop-up "security warning" (FTC).
Share a one-time code, even with someone who claims your account is at risk.

How we checked this

We built this guide on 25 October 2026 from official guidance only: the FTC's consumer pages on stalkerware, malware and phone security; the NCSC's guide to recovering a hacked account; CISA's Mobile Communications Best Practice Guidance (revised 2026); Apple Support pages on Lockdown Mode, threat notifications and Safety Check; and Google's Android and Google Play Help pages on Play Protect, safe mode and factory reset. Menu names can differ slightly by phone model and software version. We did not test commercial antivirus apps and recommend no paid product.

FAQ

Can my phone be hacked just by visiting a website or opening a message?

It is rare but possible with advanced spyware, which is why Apple's Lockdown Mode limits message attachments and some web features. For most people the real risks are malicious apps, phishing links and stolen passwords.

Does a factory reset remove spyware?

The FTC says a full factory reset may remove stalkerware. The catch is restoring: reinstall apps fresh from the app store, not from a backup of the old phone, or you could bring the spyware back.

Do I need to pay for an antivirus app?

Not necessarily. Android includes Google Play Protect at no cost, and iPhones get security fixes through iOS updates. The FTC suggests security software for removing malware and recommends choosing it through independent reviews, not ads.

Can someone hack my phone through my phone number?

A number alone doesn't give access to the phone, but criminals can try to move it to their own SIM (SIM swapping) to receive your text codes. CISA recommends a carrier account PIN and sign-in methods other than SMS.

Is a hot phone or fast battery drain always a sign of hacking?

No. Everyday things such as charging, gaming or an ageing battery can cause similar symptoms. Treat them as a reason to check for other signs, not as proof.

Sources

Last updated: 25 October 2026

Follow WorldScope on X for live updates: @worldscope_now

Search This Blog