How to tell if your phone has been hacked: signs, what to do and how to protect it

The signs of a hacked phone that matter are concrete: an app you didn't install, a setting that changed by itself, messages sent in your name, a sign-in alert from a device you don't know and, strongest of all, someone knowing things you only said over the phone. Fast battery drain, a hot or slow phone, on their own, almost never prove a hack. If you saw a concrete sign, check your apps, permissions and connected accounts, change your passwords from another device and, if needed, factory reset the phone.

What are the signs your phone has been hacked

The FTC, the US consumer protection agency, and INCIBE, Spain's national cybersecurity institute, point to similar signs. These carry the most weight:

• An app you don't recognize, sometimes with a generic system-sounding name.
• Settings changed without you touching them, such as a new device admin app or a configuration profile on an iPhone.
• Messages, emails or posts you didn't write going out from your accounts.
• An alert that your Google or Apple account was accessed from a device, place or time that isn't yours.
• Someone who knows where you have been or what you wrote, without you telling them.
• Data use far above normal, or the phone turning itself on and off and opening apps on its own.

False alarms: battery, heat and slowness

A spy app can use battery and data, but updates, a buggy app, an old battery and weak signal do the same, and they are far more common. Kaspersky, which studies this kind of software, treats these effects as possible symptoms, not proof. Another false alarm is the email claiming your phone was hacked, that you were recorded through the camera, and demanding bitcoin: according to INCIBE it is mass extortion, and it is very unlikely anyone got into the device. Don't reply and don't pay.

Cloned phone: what it really is and how to tell

What people call a cloned phone is usually one of two things, and neither touches the device. The first is SIM swapping: the criminal talks your carrier into moving your number to their SIM and then gets your calls and text-message codes. According to the FTC, the sign is your phone suddenly losing data, texts and calls, or a notice that your SIM was activated on another device. Call your carrier from another phone right away.

The second is a cloned account, when someone registers your WhatsApp on another device: that is a messaging scam, covered in our scams guide. A hacked phone is software running inside your device, which is what the rest of this guide is about.

How to tell if your phone is being monitored or spied on

The most common spy is someone close who had the phone in their hands. Surveillance apps, known as stalkerware, read messages and show your location, and they are almost always installed by someone who held the phone unlocked. Shared location, an account left signed in on another device and a tracker in a bag can also be used to watch you. On Android, in the versions available in October 2026, check the following (names vary by manufacturer):

1. Play Protect

   In the Play Store, tap your profile icon, then Play Protect, make sure Scan apps with Play Protect is on and run a scan. If it flags a harmful app, uninstall it.

2. Device admin apps

   Your Security settings list the apps allowed to administer the phone (on a Pixel, under the advanced security settings). Apart from Google's device finder and work or school apps, be suspicious.

3. Permissions

   In the permission manager, see which apps can reach your location, microphone, camera, texts and call logs.

4. Location sharing

   In Google Maps, tap your profile picture, then Location sharing; tap the name of anyone who can see where you are, then Stop.

5. Devices on your Google Account

   In your Google Account, open Security & sign-in, then Manage all devices, and sign out of any you don't recognize.

6. Physical trackers

   Under Safety & emergency, Unknown tracker alerts has a Scan now option that looks for tags travelling with you, AirTags included. It works on Android 6 and later.

On iPhone, Apple gathers the review into one tool, Safety Check, available from iOS 16:

1. Safety Check

   Go to Settings, Privacy & Security, Safety Check. Manage Sharing & Access shows who sees your location and data and lists the devices on your Apple Account; Emergency Reset cuts everything at once; Quick Exit closes the screen instantly. Non-Apple accounts are not covered.

2. Configuration profiles

   Go to Settings, General, VPN & Device Management. A profile you don't recognize can give access to data and location: tap it, then Delete Profile. If it came from work or school, check with whoever manages devices there first.

3. Apps and passcode

   Delete apps you don't recognize. If someone might know your passcode, change it to one of at least six digits, as the FTC recommends.

How to tell if your phone has a virus and how to remove it

A phone virus is, in practice, a malicious app, arriving through an app from outside the official store, a link received in a message or someone with access to the device. To remove it:

1. Update and scan

   Install system and app updates and, on Android, run Play Protect.

2. Uninstall what you don't recognize

   Delete unknown apps and anything installed from outside the store. If one won't go, first remove its device admin permission or delete the profile on iPhone.

3. Factory reset if the problem persists

   Back up photos and contacts and confirm your Google or Apple password. On iPhone it is in Settings, General, Transfer or Reset iPhone; on Android, in the system settings, with exact steps that depend on the manufacturer.

4. Don't bring the problem back

   Download your apps again from the store instead of restoring them from a backup: the FTC warns that doing so can reinstall the spy app.

My phone was hacked: what to do, step by step

1. Use another device

   Change passwords and ask for help from a computer or phone you trust.

2. Change your key passwords

   Email first, then bank, Google or Apple account, WhatsApp and social media, with a long, different password for each.

3. Sign out of every session

   In your Google Account, in Safety Check on iPhone and on social media, disconnect devices that aren't yours.

4. Turn on two-step verification

   Prefer an authenticator app or security key over text messages, which, according to the FTC, may not stop a SIM swap.

5. Talk to your carrier

   If the line went dead or the SIM was swapped without your request, get your number back and set a PIN or password for account changes.

6. Tell your bank

   If a banking app was on the phone, contact the bank through official channels and watch your statements.

How to protect your phone from hackers

• Automatic system and app updates: many of them fix flaws used to break into devices, as Brazil's CERT.br points out.
• Apps only from the official store of the system or manufacturer, never from a link in a message.
• A screen lock with a long password or a PIN of six digits or more, not shared, and auto-lock at the shortest time.
• SIM PIN: turn on the SIM card lock and change the carrier's default PIN, so no one can use your SIM in another phone.
• Permissions: allow only what makes sense and review them from time to time.
• Lockdown Mode, only if you are a target: on iPhone, in Privacy & Security, it blocks most message attachments and link previews and stops profiles from being installed. Apple says it is for very few people, those personally targeted by highly sophisticated attacks.

Stolen phone: what to do in Brazil and Spain

In Brazil, the Justice Ministry's Celular Seguro service uses a gov.br account to send an alert so partner carriers and banks block the line, the device and the accounts, even without prior registration, and it does not replace a police report. In Spain, INCIBE advises noting the IMEI (dial *#06#) to report the theft and ask the carrier to block the device. Elsewhere, report it to the police and your carrier.