How to Tell If Your Phone Is Hacked and What to Do Next

Your phone feels off. The battery is dying faster, an app you don’t remember is on the home screen, or a friend says they got a strange text from you. It’s natural to wonder if someone has broken in.

The good news is that most phones that feel “hacked” aren’t. Modern iPhones and Android phones are hard to compromise remotely, and many scary-sounding symptoms have boring explanations. The bad news is that real compromises do happen, usually through a stolen account password, a malicious app, a phishing link, a SIM swap or someone with physical access installing monitoring software.

This guide separates the warning signs worth acting on from the myths, then gives you a cleanup checklist for both iPhone and Android.

How phones actually get hacked

Knowing the common routes helps you judge your own risk.

• Your accounts, not your phone. Many “phone hacks” are really a compromised Apple, Google, email or social media account. Someone with your password can read synced messages, photos and contacts without touching your device.
• Malicious apps. Apps from outside official stores, or rare bad apps that slip into them, can steal data or show aggressive ads.
• Phishing links. Texts and emails that lead to fake login pages are far more common than technical exploits.
• Stalkerware. Monitoring apps installed by someone with physical access to your phone, often a partner or family member.
• SIM swaps. A criminal convinces your carrier to move your number to their SIM, then receives your text message codes.
• Mercenary spyware. Highly targeted tools used against journalists, activists, officials and executives. Rare for most people, but real.

Real warning signs worth acting on

These signs point to something specific and deserve a closer look.

The FTC lists several signs of stalkerware: an abuser who knows very specific information about you, someone who has or had physical access to your phone, battery drain and data use you can’t explain, and settings that change unexpectedly.

Key takeaway: The most reliable signs of a hack are account-level: logins, resets and messages you didn’t cause. Check your accounts before you assume the phone itself is infected.

Common myths that usually aren’t hacking

Plenty of normal phone behavior gets blamed on hackers.

• “My battery drains fast.” Usually aging batteries, background apps, weak signal or a recent update. See our guide to why your phone battery is draining fast. It’s only suspicious alongside other signs.
• “My phone gets warm.” Charging, gaming, video and poor reception all cause heat.
• “I hear clicks or echoes on calls.” Network quality issues. Modern spyware doesn’t make noise.
• “I got a pop-up saying my phone is infected.” That pop-up is the scam. It’s a web page trying to get you to install something or call a fake support line. Close the tab.
• “An ad matched something I talked about.” Ad targeting uses search, location and browsing data. It’s a privacy issue, but not evidence of a hack.
• “My phone is slow.” Full storage and old software are the usual causes.

Cleanup checklist for iPhone

Work through these in order. If you suspect a partner or family member installed monitoring software, read the safety note below first.

1. Update iOS. Settings > General > Software Update. Updates patch the flaws spyware relies on.
2. Review apps. Delete anything you don’t recognize or no longer use.
3. Remove unknown profiles. Settings > General > VPN & Device Management. If you see a profile you didn’t install and the phone isn’t managed by your employer or school, remove it and restart. Removing a profile also removes its settings and apps.
4. Run Safety Check. Settings > Privacy & Security > Safety Check lets you review and stop sharing location and data with people and apps, and sign out of other devices.
5. Secure your Apple Account. Change your password, confirm 2-factor authentication is on and remove devices you don’t recognize from the device list in Settings.
6. Turn on Stolen Device Protection. Settings > Face ID & Passcode. It adds extra checks before sensitive changes when you’re away from familiar places.
7. Consider Lockdown Mode if you’re a likely target. Settings > Privacy & Security > Lockdown Mode. Apple recommends it for anyone who receives a threat notification or has good reason to believe they’re individually targeted. It restricts some features in exchange for stronger protection.

Cleanup checklist for Android

Menu names vary by manufacturer, so search the Settings app if a path doesn’t match.

1. Update Android and Google Play system updates. Settings > System > Software update, and Settings > Security & privacy for system updates.
2. Run Google Play Protect. Open the Play Store, tap your profile icon, then Play Protect > Scan. Play Protect also scans automatically and may disable or remove harmful apps it finds.
3. Review apps and permissions. Uninstall apps you don’t recognize. Check which apps have accessibility access, device admin rights and permission to install unknown apps, and remove those you didn’t grant on purpose.
4. Use safe mode if an app won’t uninstall. Safe mode temporarily disables third-party apps so you can remove a troublesome one. The steps vary by phone maker.
5. Secure your Google Account. Change your password, review the Security page for recent activity and signed-in devices, and remove anything unfamiliar.
6. Run a Security Checkup. Google’s Security Checkup walks through recovery options, third-party access and saved passwords.

Secure your accounts and your phone number

Whichever phone you use, these steps protect you even if the device itself is clean.

• Change passwords for email, Apple or Google, banking and social media, from a device you trust. A password manager makes unique passwords practical.
• Turn on MFA everywhere, ideally with an authenticator app or passkeys instead of text messages.
• Sign out of all sessions in your key accounts to kick out anyone already logged in.
• Lock your phone number. Ask your carrier about a port-out PIN or number lock. If your service suddenly drops and you didn’t change anything, call the carrier right away from another phone.
• Watch your financial accounts. If you think your data was taken, follow our checklist for what to do after a data breach.

A safety note on stalkerware

If you suspect someone close to you installed monitoring software, removing it can alert them. The FTC advises talking with a domestic violence counselor and making a safety plan before you uninstall anything. In the US, the National Domestic Violence Hotline is available at 1-800-799-7233. Consider using a different device, such as a library computer, to research and get help.

When to factory reset

A factory reset is the strongest fix you can do yourself. Use it when you’ve found clear evidence of compromise and the steps above didn’t resolve it.

1. Back up your phone first, but be selective. Photos and contacts are fine; avoid restoring apps you suspect.
2. Reset: on iPhone, Settings > General > Transfer or Reset iPhone > Erase All Content and Settings. On Android, Settings > System > Reset options.
3. Set the phone up as new where possible, update it fully, then reinstall apps only from the official store.
4. Change your account passwords again after the reset.

If you received an Apple threat notification or believe you’re targeted by professional spyware, a reset may not be enough. Apple recommends getting expert help, such as Access Now’s Digital Security Helpline.

The bottom line

Most phones aren’t hacked, but accounts often are. Focus on the signs that point to something concrete: apps, logins, messages and settings you didn’t cause. Keep your phone updated, remove what you don’t recognize, secure your accounts with strong passwords and MFA, and lock your number with your carrier. If you want to understand what you’re looking for, our guide to types of malware explains how spyware, adware and other threats behave.

Sources

• FTC: Stalkerware: What to Know — signs of stalkerware and safety planning before removal
• FTC: How to Recognize, Remove, and Avoid Malware — general malware signs and removal steps
• Apple Support: About Apple threat notifications and protecting against mercenary spyware — threat notifications, Lockdown Mode, recommended security steps
• Apple Personal Safety User Guide: Delete unknown configuration profiles — where to find and remove profiles
• Google Play Help: Use Google Play Protect — app scanning and removal of harmful apps