5 Signs Your Phone May Be Hacked

1. Your Battery Drains Unusually Fast

Spyware and other malicious apps can run quietly in the background, collecting data and sending it out. That work uses power. The FTC lists "Is my battery draining faster than usual?" among the questions to ask if you are worried about stalkerware on your phone (FTC).

Look for a change: a phone that used to last all day and now dies by lunch, with no change in how you use it, is worth checking.

• Innocent explanation: Batteries wear out with age and hold less charge over time.
• Innocent explanation: Heat matters. Google notes that a battery drains much faster when the phone is hot, even when it is not in use (Android Help).
• Innocent explanation: A new app, a fresh software update, poor signal, GPS navigation, video streaming and bright screens all use more power.

What to check: Open your battery settings and see which apps use the most power. On iPhone, Apple explains how to read battery usage in Settings > Battery. On Android, open Settings > Battery. An app you do not recognize near the top of that list deserves a closer look.

2. Unexpected Mobile Data Use

Spyware has to send what it collects somewhere, and that usually means using your internet connection. The FTC lists "Am I unexpectedly using more data?" as another warning sign (FTC). A sudden jump on your phone bill, or a data cap you hit far earlier than usual, can be a clue.

• Innocent explanation: Automatic app updates, photo and video backups, and streaming over mobile data instead of Wi-Fi.
• Innocent explanation: A Wi-Fi connection that keeps dropping, so the phone quietly falls back to mobile data.

What to check: Look at data use per app. On iPhone, Apple shows which apps use cellular data in Settings > Cellular (called Mobile Data in some regions). On Android, look in Settings > Network & internet for data usage by app. The exact name varies by phone maker. An unfamiliar app that sends a lot of data is a red flag.

3. Pop-Ups, Settings Changes and Strange Behavior

Malware often makes itself known through behavior you did not ask for. The FTC lists lots of pop-up ads and a browser home page that changes or redirects you as common malware signs (FTC). For stalkerware, it adds a phone that overheats or turns off and on unexpectedly (FTC).

Other things to watch for include security settings that switch themselves off, a new home screen or keyboard you did not install, or permissions you are sure you never granted.

• Innocent explanation: Many free apps and websites show aggressive ads. Pop-ups inside one app or one website usually point to that app or site, not a hacked phone.
• Innocent explanation: Software updates can reset settings, and low storage, an aging battery or a buggy app can cause restarts.

4. Unknown Apps or Messages You Did Not Send

This is one of the stronger signs of phone hacking. An app you never installed, or friends asking about texts, emails or social posts you never sent, means you should act quickly. The FTC names "emails you didn't write or social media messages you didn't post" as a malware sign (FTC), and says that friends receiving messages you did not send is a sign an account was hacked (FTC).

Spyware can also hide in plain sight. The FTC notes that stalkerware may use a harmless-sounding name such as "System Service" (FTC).

• Innocent explanation: Phone makers and carriers preinstall apps you may never have noticed before.
• Innocent explanation: Someone else in your household may have installed an app or used your phone.
• Innocent explanation: Messages "from you" may come from a hacked online account rather than a hacked phone. That still needs fixing, but the fix starts with the account password.

Also watch for account alerts. The FTC lists login notices from a device you do not recognize, and password changes you did not make, as signs of a hacked account. Apple adds a two-factor authentication code you did not request (Apple).

5. Unusual Sounds or Interruptions During Calls

Clicks, echoes, static or calls that drop are often listed online as proof that someone is listening. Treat that claim with caution. Call noises alone are not reliable evidence of surveillance. Weak signal, network congestion, switching between Wi-Fi calling and mobile networks, a damaged headset, a Bluetooth device and problems on the other caller's end all cause the same sounds.

What is more meaningful is a pattern combined with other signs. For example, your phone suddenly losing all service, unexpected texts about a SIM change, or calls and texts that seem to be forwarded elsewhere. These can point to account or phone number takeover rather than a bugged call. The FTC warns that criminals can take over your phone number through a SIM swap attack (FTC), and Apple advises checking with your carrier that SMS forwarding has not been set up (Apple).

How to Check an Android Phone

If you think your Android phone is hacked, work through these checks. Menu names vary slightly between phone makers, but the steps are similar.

• Run Google Play Protect: Open the Play Store, tap your profile icon, then Play Protect. Google says Play Protect is on by default and recommends you always keep it on. If it flags an app, tap the notification and choose Uninstall (Android Help).
• Review installed apps: Open Settings > Apps and scroll the full list. Look for apps you do not recognize, apps with generic names, and apps with no icon.
• Review permissions: Open Settings > Security & privacy > Privacy > Permission manager to see which apps can use your camera, microphone, location, SMS and contacts (Android Help).
• Check battery and data use: Settings > Battery and your data usage screen show which apps work hardest in the background.
• Use safe mode to find a problem app: Google explains how to restart in safe mode, which runs the phone without downloaded apps. If the problem disappears, remove recently downloaded apps one by one (Android Help).
• Check for updates: Settings > System > Software updates. Google also shows your Android version and security update date in Settings > About phone (Android Help).

How to Check an iPhone

iPhones only install apps from the App Store unless they have been jailbroken or set up with special profiles, which makes classic malware rarer. An iPhone can still be affected by account takeover, risky sharing settings or, in rare targeted cases, advanced spyware. If you think your iPhone is hacked, check these areas.

• Run Safety Check: On iOS 16 or later, open Settings > Privacy & Security > Safety Check. Apple says it lets you review and reset who and which apps can access your information, and change your passcode and Apple Account password (Apple).
• Review app access: In Settings > Privacy & Security, check which apps can use your location, photos, contacts, microphone and camera (Apple).
• Check signed-in devices: Open Settings, tap your name and scroll down to see every device on your Apple Account. Tap any device you do not recognize and choose Remove from Account (Apple).
• Check battery and data use: Settings > Battery and Settings > Cellular show which apps use the most power and data.
• Update iOS: Settings > General > Software Update. Apple calls keeping software up to date one of the most important things you can do for your device's security (Apple).

If your job or public role makes you a likely target of sophisticated attackers, Apple offers Lockdown Mode. Apple describes it as an optional, extreme protection for the very few individuals who may face such threats (Apple).

How to Spot Suspicious Apps and Permissions

Many problems come from an app that asked for more access than it needed. Use these questions to judge any app on your phone:

• Do I remember installing it? If not, research the exact name before removing it, because some system apps are needed.
• Do its permissions match its purpose? A flashlight or wallpaper app has no reason to read your texts, record audio or track your location.
• Does it have special powers? Be wary of apps with accessibility access, device admin rights or permission to read notifications. These powers let an app see and control a lot of your phone.
• Where did it come from? Apps installed outside the official app store carry more risk.
• Is it still needed? Remove apps you no longer use. Google recommends removing apps you do not need as part of keeping your account secure (Google).

When in doubt, remove the permission first. On both Android and iPhone you can switch off a single permission, such as location or microphone, without deleting the app.

How to Check Your Google and Apple Account Security

Your phone is only as safe as the accounts signed in to it. Many "hacked phone" cases are really hacked accounts, so check these even if the phone itself looks clean.

• Google: Run the Security Checkup at myaccount.google.com/security-checkup. Then open your Google Account > Security & sign-in, review Recent security events, remove devices you do not recognize and check Gmail forwarding and filters (Google).
• Apple: Sign in at account.apple.com, review your personal and security details, select Devices and remove anything unfamiliar (Apple).
• Email and social accounts: The FTC recommends changing the password, signing out of all devices, checking recovery email addresses and phone numbers, and deleting forwarding rules you did not set up (FTC).

What to Do Right Away If You Suspect a Hack

If the checks above turn up something real, act in this order:

• Stop signing in to sensitive accounts on the suspect phone. The FTC advises you to stop logging in to online accounts on a device you think has malware (FTC).
• Move to a trusted device, such as a computer or another phone you know is clean, for the steps that follow.
• Change your most important passwords from that trusted device, starting with your email, Apple or Google account and bank.
• Sign out of all sessions and remove unknown devices from your accounts.
• Remove suspicious apps, run Play Protect on Android, and install all available updates.
• Call your bank if you see payments you did not make, and your carrier if you lost service or see SIM or forwarding changes.
• Warn your contacts if messages were sent in your name, so they do not click links that appear to come from you.

Change Passwords From a Trusted Device and Turn On MFA

If your phone may be compromised, anything you type on it may be compromised too. That is why password changes should happen on a different device you trust. Once the phone is cleaned, updated or reset, you can safely sign back in on it.

Next, turn on multifactor authentication (MFA), also called two-factor authentication or 2-Step Verification. CISA explains that even if a password is stolen, MFA means unauthorized users still cannot get past the second step (CISA). Start with your email, bank, Apple or Google account and social media.

• Google: Go to your Google Account > Security & sign-in and choose Turn on 2-Step Verification (Google).
• Apple: On iPhone, open Settings > [your name] > Sign-In & Security and turn on two-factor authentication (Apple).
• Pick the strongest option you can: The FTC says authenticator apps are safer than text message codes, because criminals can take over a phone number through a SIM swap, and that security keys are the strongest method (FTC). NIST also notes that SMS codes and one-time codes can be phished, while FIDO authenticators such as passkeys and security keys resist phishing (NIST).

For a step-by-step walkthrough, read our guide on how to turn on MFA for your most important accounts.

Update, Back Up and Secure Your Phone

Prevention is simpler than recovery. These habits close most of the doors attackers use and are the core of how to secure your phone:

• Turn on automatic updates: CISA advises installing updates as soon as possible and turning on automatic updates (CISA). On iPhone, use Settings > General > Software Update > Automatic Updates (Apple).
• Use a strong screen lock: The FTC recommends at least a 6-digit passcode (FTC).
• Back up regularly: The FTC advises backing up your phone to the cloud or a computer. Android backups are covered in Android Help, and iPhone backups in Apple Support.
• Turn on Find My Device or Find My iPhone so you can lock or erase a lost phone.
• Install apps only from the official store, keep Play Protect on, and review permissions every few months.
• Be careful with links in texts and emails. Apple advises not to follow links or open attachments in suspicious or unsolicited messages (Apple). Our delivery text scams guide shows how fake package texts work.

When a Factory Reset or Professional Help Makes Sense

A factory reset erases everything on the phone and returns it to its original state. Google notes that it erases all your data and recommends trying other solutions first if you are resetting to fix a problem (Android Help). Consider a reset when you found spyware or a malicious app you cannot remove, when strange behavior continues after removing suspicious apps and updating, or when you are passing the phone to someone else.

• Before you reset: Back up your photos and important files, and make sure you know your Google or Apple Account password. Google advises confirming your Google Account username and password before an Android reset.
• Android: Follow Google's factory reset steps or your phone maker's instructions.
• iPhone: Go to Settings > General > Transfer or Reset iPhone > Erase All Content and Settings (Apple).
• After the reset: The FTC suggests not restoring apps from a backup of a compromised phone. Download them fresh from the app store instead (FTC).

Get professional help if money was stolen (call your bank), if your phone number was taken over (call your carrier), if you suspect stalking or abuse (contact a domestic violence advocate or the police), or if the phone belongs to your employer (contact your IT or security team right away). Organizations that manage staff phones can follow NIST guidance on mobile device security (NIST).

Free Security Resources From Ian Job

Found this guide on Pinterest? Save it, then use these free resources to keep your phone and accounts safer:

• Not sure about a link in a text or email? Check it with the Suspicious URL Analyzer before you tap.
• Got a suspicious email? Paste its headers into the Phishing Email Header Analyzer to see where it really came from.
• Lock down your accounts with our guide on how to turn on MFA for your most important accounts.
• Learn the red flags of fake package texts in our delivery text scams guide.
• Browse all personal security guides and free security tools.

Conclusion: Stay Calm, Check, Then Lock It Down

Fast battery drain, extra data use, odd behavior, unknown apps and strange calls can all be signs your phone may be hacked. Most of the time they have an everyday cause. What matters is that you now know how to check: review your apps and permissions, look at battery and data use, and confirm which devices are signed in to your accounts.

Whatever you find, the same habits make you much harder to attack: automatic updates, a strong passcode, MFA on every important account, regular backups and a healthy pause before tapping any link. Pick one of those today and turn it on. Your future self will thank you.