If you want to know how to know if your phone is hacked, look for a cluster of changes you didn’t cause: apps you never installed, settings that flipped on their own, login codes you didn’t request, and messages sent from your accounts. One odd symptom on its own, like a warm phone or a fast-draining battery, is usually just normal wear or a heavy app.
The good news is that you can confirm most problems yourself in about 20 minutes. Both iPhone and Android now include built-in tools that show which apps touched your camera, microphone and location, which devices are signed in to your account, and which profiles control your phone.
This guide walks you through every warning sign, the exact settings to check on each platform, what dial codes can and can’t tell you, and a step-by-step recovery plan if something is wrong.
| Quick fact | What you need to know |
|---|---|
| Most reliable sign | Account activity you didn’t do: new logins, password reset emails, sent messages you didn’t write |
| Weakest sign on its own | Battery drain or heat, because normal apps, age and updates cause both |
| Best built-in iPhone check | Safety Check (iOS 16+) and App Privacy Report (iOS 15.2+) |
| Best built-in Android check | Play Protect scan and the Privacy dashboard (Android 12+) |
| What *#21# does | Shows whether your calls are being forwarded. It can’t detect malware |
| Fastest emergency step | Turn on airplane mode, then change key passwords from a different device |
| Last-resort fix | Back up, then factory reset and reinstall apps by hand |
| Extra help for high-risk people | Apple Lockdown Mode or Android Advanced Protection |
Hacked, Infected or Just Glitchy? Know What You’re Dealing With
Before you panic, it helps to understand that “my phone is hacked” can mean four very different things. Each one has different symptoms and a different fix.
1. Your device is compromised. Malware, spyware or a rogue configuration profile is running on the phone itself. This is the classic “hacked phone” and the rarest of the four for most people.
2. Your accounts are compromised. Someone has your Apple Account, Google Account, email or social media password. Your phone itself is clean, but whatever syncs to it is not. This is far more common, and it often looks like a phone hack because messages, photos and logins show up across your devices.
3. Your phone number is hijacked. In a SIM swap or port-out scam, a criminal convinces your carrier to move your number to their SIM. Your phone suddenly loses service, and their phone starts receiving your texts and security codes.
4. You’re seeing scareware or a glitch. A web page shows a fake “your phone is infected” alert, or a buggy update makes your phone hot and slow. Nothing has broken in, but the symptoms feel alarming.
| What’s happening | Typical clues | Where to look first |
|---|---|---|
| Device compromise | Unknown apps, unknown profiles, permissions you never granted, pop-ups outside the browser | App list, VPN & Device Management (iPhone), Device admin and accessibility apps (Android) |
| Account takeover | Login alerts, password reset emails, sent messages you didn’t write, new devices on your account | Apple Account or Google Account device list and security activity |
| SIM swap or port-out | Sudden “No Service” or “SOS only”, carrier texts about a SIM change, missing 2FA codes | Call your carrier from another phone right away |
| Scareware or glitch | Alarming pop-ups only inside one browser tab, heat after an update | Close the tab, clear site data, update apps |
Sorting your problem into one of these buckets saves you time. A factory reset will not fix a stolen Google password. A new password will not fix a SIM swap.
How Phones Get Hacked in the First Place
Knowing the common entry points makes the warning signs easier to read. Here are the routes attackers use most, from the most common to the rarest.
Phishing links and fake login pages
Most phone “hacks” start with a message. A text, email or chat claims your package is stuck, your bank account is locked or your Apple ID needs checking. The link leads to a fake login page or prompts you to install something.
Attackers increasingly use AI-generated voices and faces to make these lures more convincing. Our explainer on deepfake-as-a-service shows how cheap these tools have become.
Malicious or fake apps
Fake apps copy the name and icon of a real one, then ask for far more permissions than they need. They mostly spread through unofficial app stores, direct download links and sideloaded files, which is why sticking to the official store matters.
On Android, the riskiest apps request accessibility access or device admin rights. Those permissions let an app read your screen, tap buttons for you or stop you from uninstalling it.
Public and fake Wi-Fi networks
A fake hotspot with a convincing name, often called an evil twin, can redirect you to malicious sites or capture logins sent over unencrypted connections. Modern apps encrypt most traffic, so the bigger risk is being steered to a fake login page.
Physical access and stalkerware
Someone who knows your passcode and has your phone for a few minutes can install monitoring software or add their own face or fingerprint. The FTC describes stalkerware as an app someone installs on your phone without your knowledge to track your activity.
This is the scenario where the attacker is often a partner, ex or family member, and it needs a careful, safety-first approach. We cover that in its own section below.
SIM swapping and number porting
Here, nobody touches your phone at all. A criminal impersonates you to your carrier and moves your number to a SIM they control. They then use your number to receive password reset codes for your email, bank and social accounts.
Account takeover from data breaches
If your password leaked in a breach and you reuse it, attackers can sign in to your accounts without any malware. Big breaches like the Pentagon data breach and the ShinyHunters FBI breach are reminders that your details can leak through organizations you trust.
Mercenary spyware
At the far end of the scale are commercial spyware tools such as Pegasus. These can infect a phone with little or no user action. Proton’s guide cites reporting that Pegasus was used against at least 180 journalists in several countries.
Apple describes these attacks as far more sophisticated than everyday cybercrime and says most users will never be targeted. If you’re a journalist, activist, lawyer, executive or public figure, though, this is worth your attention.
15 Warning Signs Your Phone Might Be Hacked
No single item on this list proves a hack. What matters is how many signs appear together, and whether they started suddenly without a clear reason like a new app or an update.
1. Apps you don’t remember installing
This is one of the strongest signs. Scroll through your full app list, not just your home screen, because hidden apps often skip the home screen entirely. Watch for apps with blank names, random letters or generic names like “System Service”.
2. Settings that changed on their own
Did two-factor authentication switch off? Did camera or microphone access appear for an app that never needed it? Proton and Avast both list unexplained setting changes as a key red flag, because malware and intruders often weaken protections first.
3. Login codes and reset emails you didn’t request
Norton flags unwanted verification codes as a warning sign. A code you didn’t ask for means someone typed your username or phone number into a login or reset page. It’s a sign your account is being targeted, even if the phone itself is clean.
4. Messages or calls you didn’t send
Check your sent texts, call log and social media DMs. Samsung’s own troubleshooting guide tells Galaxy owners to look for messages they didn’t send and calls they didn’t make. Friends asking “did you just send me this link?” is a classic sign of account takeover.
5. New devices or sessions on your accounts
A device you don’t own in your Apple Account or Google Account device list is a serious red flag. So is a login session from a city you’ve never visited. We show you exactly where to look in the checklist sections below.
6. Camera or microphone indicators when you’re not using them
On iPhone with iOS 14 or later, an orange dot means an app is using the microphone. A green dot means the camera, or the camera and microphone, is in use. Android 12 and later shows a green indicator in the top-right corner when an app uses either.
If you see one while no app should be listening or watching, find out which app triggered it.
7. Battery draining much faster than usual
Malware running in the background uses power. But so do GPS apps, games, poor signal and an aging battery. Treat battery drain as a supporting clue only. Check your battery usage screen for an app you don’t recognize near the top.
8. Phone running hot when it’s idle
Heat while gaming or charging is normal. Heat while the phone sits untouched in your pocket, night after night, is worth a look. The FTC lists unusual overheating among the signs of stalkerware.
9. A jump in mobile data use
Spyware has to send what it collects somewhere. If your data use spikes without a change in your habits, open the data usage screen and see which app is responsible. Your carrier bill can confirm the jump.
10. Pop-ups outside your browser
A pop-up inside one web page is usually just an aggressive ad. Pop-ups that appear on your home screen, over other apps or right after unlocking suggest adware is installed. Don’t tap them, even to close them, if they look like system warnings.
11. Slowness, crashes and random restarts
Apps freezing, the phone rebooting on its own, or features suddenly breaking can be a symptom of malicious code fighting for resources. It’s also common after a big OS update, so compare against the timing of your last update.
12. Strange charges on your bill or accounts
Avast lists unexpected charges on your phone bill as a warning sign. Look for premium SMS charges, subscriptions you didn’t start and in-app purchases you didn’t make. Check linked payment apps and cards too.
13. Sudden loss of signal
If your phone shows “No Service” or “SOS only” in a place where it always worked, and your carrier has no outage, call them from another phone. This is the main warning sign of a SIM swap, and every minute counts.
14. Someone knows things they shouldn’t
The FTC notes that an abuser knowing your location, private conversations or online activity without being told is a sign of stalkerware. Trust this feeling. It’s often more reliable than any technical symptom.
15. Your browser or accounts look different
A new home page, a search engine you didn’t choose, a browser extension you don’t recognize, or an email forwarding rule you never set up all point to tampering. Email forwarding rules are a favorite trick because they quietly copy every message to the attacker.
| Sign | How strong a clue? | Most likely cause |
|---|---|---|
| Unknown apps or profiles | Strong | Malware, stalkerware or an unwanted management profile |
| Unrequested login codes | Strong | Someone trying to sign in to your account |
| Messages you didn’t send | Strong | Account takeover |
| New devices on your account | Strong | Account takeover |
| Sudden “No Service” | Strong | SIM swap, or a carrier outage |
| Camera/mic indicator at odd times | Medium | Over-permissioned app or spyware |
| Data use spike | Medium | Background app, sync, or spyware |
| Pop-ups outside the browser | Medium | Adware |
| Battery drain | Weak alone | Usually normal use or battery age |
| Heat | Weak alone | Usually charging, gaming or poor signal |
| Slowness or crashes | Weak alone | Usually storage, bugs or an old device |
How to Check If Your Phone Is Hacked in Settings
You don’t need a paid app to run a solid first check. Both major platforms now ship with privacy and security tools that would have required third-party software a few years ago. Work through the list for your phone, and write down anything that looks off.
iPhone: 8 settings to check
- Run Safety Check. Go to Settings > Privacy & Security > Safety Check. It needs iOS 16 or later and an Apple Account with two-factor authentication. Choose Manage Sharing & Access to review which people, apps and devices can see your data.
- Review devices on your Apple Account. Safety Check lists the devices connected to your Apple Account. You can also see them at account.apple.com. Remove anything you don’t own.
- Look for configuration profiles. Go to Settings > General > VPN & Device Management. Apple notes that if nothing appears there, no profiles are installed. A profile you didn’t knowingly add on a personal phone deserves a close look.
- Turn on App Privacy Report. Go to Settings > Privacy & Security > App Privacy Report (iOS 15.2 or later). It shows how often apps accessed your location, photos, camera, microphone and contacts over the past seven days, and which domains they contacted. It only collects data after you switch it on, so check back in a day or two.
- Check camera and microphone permissions. In Settings > Privacy & Security, tap Camera and Microphone. Turn off access for any app that has no clear reason to use them.
- Review Face ID or Touch ID enrollments. If someone added an alternate appearance or an extra fingerprint, they can unlock your phone. Re-enroll your own face or fingerprints if you’re unsure.
- Check your full app list. Swipe left past your last home screen to the App Library and use the search bar to scroll the alphabetical list. Delete anything you don’t recognize.
- Check battery and storage usage. Settings > Battery and Settings > General > iPhone Storage both show which apps use the most resources. An unfamiliar name near the top is worth researching.
If you’ve found a suspicious app, our guide on how to remove a virus from your iPhone walks you through the clean-up steps.
Android: 8 settings to check
Menu names vary slightly by brand. The paths below follow Google’s and Samsung’s help pages.
- Run a Play Protect scan. Open the Google Play Store, tap your profile icon, choose Play Protect, then Scan. Google says Play Protect checks apps from Play before you download them, and also checks for harmful apps from other sources.
- Open the Privacy dashboard. Go to Settings > Security and Privacy > Privacy dashboard (or Settings > Privacy). On Android 13 and up it shows the last seven days of camera, microphone, location and other permission use. Android 12 shows the last 24 hours.
- Check accessibility services. In Settings > Accessibility, look under installed or downloaded apps. Very few apps legitimately need this power, and spyware loves it.
- Check device admin apps. Search Settings for “device admin”. Apps listed here can resist being uninstalled. Anything other than Find My Device, your work profile or a known security app deserves scrutiny.
- Check “Install unknown apps”. Search Settings for “unknown apps”. Make sure your browser, messaging apps and file managers are not allowed to install apps unless you deliberately need that.
- Review your Google Account devices. In Settings > Google > Manage your Google Account > Security, check Your devices and Recent security activity. Sign out of anything you don’t recognize.
- Look at data and battery usage. Samsung’s guide suggests Settings > Connections > Data usage to spot unusual traffic. On other Android phones, search Settings for “data usage” and “battery usage”.
- On Samsung, run App protection. Go to Settings > Security and privacy > App security > App protection and tap Scan phone. Samsung notes this may not be available on every model and carrier.
Use Safe mode to unmask a stubborn app (Android)
Safe mode starts your phone without any third-party apps. If the pop-ups, heat or slowness disappear in Safe mode, a downloaded app is almost certainly the cause.
Samsung recommends booting into Safe mode, opening Settings > Apps, and uninstalling apps with blank or random names or that you don’t recognize. Restart normally afterwards and see if the symptoms return.
What to Dial to See If Your Phone Is Hacked
You’ve probably seen videos claiming a secret code will reveal a hack. The truth is more limited. These are network codes that check call forwarding, not malware scanners. They’re still useful, because hidden forwarding lets someone intercept your calls and the one-time codes some services read out by voice.
| Code | What it checks | How to turn it off |
|---|---|---|
| *#21# | Whether all incoming calls are forwarded (unconditional forwarding) | ##21# |
| *#61# | Where calls go when you don’t answer | ##61# |
| *#62# | Where calls go when your phone is unreachable (off, no signal, airplane mode) | ##62# |
| *#67# | Where calls go when you’re busy or reject a call | ##67# |
| *#06# | Shows your IMEI, the phone’s unique 15-digit ID | Nothing to turn off |
A few things to keep in mind when you use these codes:
- Seeing a number isn’t automatically bad. Conditional forwarding (*#61#, *#62#, *#67#) usually points to your carrier’s voicemail number. Look that number up before you panic.
- Results depend on your carrier. The reply comes from the network, so the wording, and whether the code works at all, varies between providers.
- They can’t see apps. Surfshark makes the same point: dial codes help you spot suspicious redirections but can’t confirm a hack. A clean *#21# result tells you nothing about spyware.
- Write down your IMEI. It won’t show a hack, but your carrier or police may ask for it if your phone is stolen or you need the device blocked.
How to Know If Your iPhone Is Hacked: iPhone-Specific Clues
iPhones are harder to infect with traditional malware because apps are sandboxed and normally come only from the App Store. That shifts the risk. On an iPhone, your Apple Account and any installed profiles are the usual weak points.
Look for these iPhone-specific warning signs:
- Apple account alerts you didn’t trigger. Apple lists notifications or emails about account activity you don’t recognize as a sign your account may be compromised.
- Two-factor codes you didn’t request. Apple flags this directly in its compromised-account guidance.
- Your device was locked or put in Lost Mode by someone else. Apple names this as a red flag, since it means someone else controls your Find My.
- A configuration profile you didn’t install. Profiles can manage settings and may grant access to sensitive data or location, according to Apple’s personal safety guide.
- A jailbreak you didn’t perform. Jailbreaking removes built-in security protections, as Surfshark’s guide points out. An unfamiliar third-party app store on your iPhone is a major warning sign.
- An Apple threat notification. Apple sends these only when it believes you may be individually targeted by mercenary spyware. They appear at the top of account.apple.com, by email and as an iPhone alert.
Be wary of fake threat notifications too. Apple says genuine ones never ask you to click links, open files, install apps or profiles, or give your Apple Account password or code. If you get one, sign in to account.apple.com directly to confirm it’s real.
Apple keeps adding security features with each iOS release. Our WWDC 2026 recap of iOS 27 covers the latest changes, and our list of hidden iPhone features includes a few privacy tools many owners miss.
Android Red Flags to Watch For
Android’s openness is a strength, but it also gives malicious apps more room to work. Most Android infections arrive through sideloaded apps or apps that abuse powerful permissions.
Watch for these Android-specific signs:
- An app you can’t uninstall. If the Uninstall button is greyed out, the app may have device admin rights. Remove those rights first, then uninstall it.
- An app hiding its icon. Some spyware removes its launcher icon. Check Settings > Apps for the full list, including system-looking names.
- Accessibility access you didn’t grant. This lets an app read what’s on screen and act on your behalf.
- Play Protect turned off. Malware sometimes disables it. Make sure it’s on and scanning.
- “Unknown sources” enabled for random apps. This lets those apps install other apps silently after you approve once.
- Ads covering your home screen. Samsung notes that some ads claim your phone is hacked to scare you into tapping them. Don’t.
Samsung owners can also turn on Auto Blocker at Settings > Security and privacy > Auto Blocker. Samsung says it blocks threats and suspicious activity, and Maximum restrictions adds more protection at the cost of some features.
Is It the Phone or Your Accounts? Check Both
Many people reset their phone, restore the same backup and sign back in to the same compromised accounts. The problem comes straight back. That’s why your account check matters as much as your device check.
Your Apple Account
Apple’s guidance for a possibly compromised account comes down to four moves:
- Change your password to a strong, unique one. If you can’t sign in, use Apple’s account recovery.
- Review your account details at account.apple.com and fix anything you don’t recognize, such as a changed email address or trusted phone number.
- Remove devices you don’t recognize from your device list.
- Check your email and phone accounts too, including any SMS forwarding you didn’t set up.
Apple also recommends two-factor authentication and, for people facing targeted attacks, security keys.
Your Google Account
Google’s recovery steps for a hacked account follow the same pattern:
- Regain access through Google’s account recovery page if you’re locked out.
- Review recent security activity and remove devices you don’t recognize.
- Turn on 2-Step Verification, which pairs your password with something you have, such as your phone or a security key.
- Check Gmail, Drive and Photos settings for changes you didn’t make, especially forwarding and recovery details.
- Change any password you reused on other sites, and alert your bank if payment details were stored.
Email, banking and social accounts
Your email account is the master key, because password resets for everything else go there. Check it first. Look for forwarding rules, filters that send mail to trash, connected apps and recovery addresses you didn’t add.
Then check banking and payment apps for small test charges. Fraudsters often try a tiny purchase before a large one. Banks are getting better at spotting this pattern with AI, as we explain in our guide to how AI detects and prevents fraud.
What to Do If Your Phone Is Hacked: A 10-Step Recovery Plan
If your checks turned up real evidence, act in this order. The sequence matters, because changing passwords on an infected phone can hand the new passwords straight to the attacker.
- Cut the connection. Turn on airplane mode, then make sure Wi-Fi and Bluetooth are off too. This stops the phone sending or receiving data while you work.
- Grab a clean device. Use a computer or another phone you trust for every password change that follows.
- Secure your email first. Change the password, sign out of all other sessions, and remove unknown forwarding rules and recovery addresses.
- Secure your Apple Account or Google Account. Change the password, remove unknown devices and confirm your recovery phone number.
- Change banking, payment and social passwords. Start with anything that can move money. Use a new, unique password for each.
- Turn on two-factor authentication everywhere it’s offered, preferring an authenticator app, passkey or security key over SMS.
- Remove suspicious apps and profiles. Delete unknown apps, revoke device admin or accessibility access, and delete unwanted profiles. Restart and check again.
- Run a security scan. Use Play Protect or your phone maker’s built-in scanner on Android. On either platform, a reputable security app can add a second opinion.
- Warn your contacts. If messages went out from your accounts, tell friends and family to ignore links from you for now.
- Call your carrier and bank if you saw SIM problems or unknown charges. Ask your carrier about extra account protections, which we cover below.
| Situation | Do this first | Then |
|---|---|---|
| Unknown app found, accounts look fine | Uninstall it, restart, rescan | Change passwords that app could have seen |
| Login alerts or sent messages you didn’t write | Secure email and main account from another device | Review connected apps and forwarding rules |
| “No Service” with no outage | Call your carrier from another phone | Secure email and banking, since codes may be intercepted |
| Symptoms survive app removal | Back up photos and files | Factory reset and set up as new |
| You suspect a partner or family member | Read the stalkerware section before changing anything | Contact an advocate from a safe device |
| You got an Apple threat notification | Confirm it at account.apple.com | Turn on Lockdown Mode and seek expert help |
When a Factory Reset Is (and Isn’t) the Answer
A factory reset erases apps, data and settings, which removes almost all ordinary malware. It’s the right move when symptoms survive after you’ve removed suspicious apps and profiles.
It’s the wrong first move in two cases. First, if your accounts are the problem, a reset changes nothing, because you’ll sign straight back in. Second, if you may be dealing with stalkerware from someone close to you, wiping the phone can alert them and destroy evidence you may need.
How to reset safely
- Back up only what you need. Save photos, videos, documents and contacts. Avoid restoring a full device backup afterwards, because it can bring back the same apps and settings.
- Secure your accounts first, from a clean device, so you don’t sign back into compromised accounts.
- Erase the phone. On iPhone, go to Settings > General > Transfer or Reset iPhone > Erase All Content and Settings. On Android, look for Settings > General management > Reset > Factory data reset (Samsung) or search Settings for “factory reset”.
- Update the operating system straight after setup.
- Reinstall apps by hand from the official store, one at a time. Skip anything you don’t really need.
If problems continue after a clean reset, Samsung’s advice for Galaxy owners is to visit a service center or book a repair. The same goes for other brands: hardware or firmware faults can mimic a hack.
If Someone You Know Might Be Watching You
If you suspect a partner, ex or family member is tracking you, your safety comes before your phone. The FTC warns that removing stalkerware or changing settings could tip off an abuser, which can make things more dangerous.
Here’s the safer approach the FTC recommends:
- Reach out for support first. Call the National Domestic Violence Hotline at 1-800-799-7233, chat at thehotline.org, or text START to 88788.
- Use a different device to look for help, such as a library computer or a friend’s phone. Assume the suspect phone is being watched.
- Document what you see before you change anything, such as screenshots of unknown apps or messages that show someone knows too much.
- Consider a new phone with a new account if you need communication the other person can’t see.
On iPhone, Safety Check was built for this situation. Emergency Reset immediately stops sharing with all people and apps. Manage Sharing & Access lets you review and change sharing one item at a time. The Quick Exit button closes Settings instantly if someone walks in.
Safety Check has limits. Apple says it can’t review non-Apple accounts and passwords or what you share on social media. You’ll need to check those separately.
Targeted Spyware: When Standard Checks Aren’t Enough
Commercial spyware is designed to leave few visible traces. Battery checks and app lists usually won’t reveal it. If your work or profile makes you a likely target, add these layers.
Apple Lockdown Mode
Lockdown Mode is Apple’s extreme protection setting, available on iOS 16 and later. Apple says it’s meant for the very few people who might be personally targeted because of who they are or what they do.
When it’s on, most message attachment types are blocked, some complex web technologies are limited, FaceTime calls from people you haven’t contacted in the last 30 days are blocked, accessories need an unlocked phone to connect, and non-secure Wi-Fi is rejected. Regular calls, texts and emergency features still work.
Turn it on at Settings > Privacy & Security > Lockdown Mode, then tap Turn On Lockdown Mode and restart.
Android Advanced Protection
Google’s Advanced Protection for Android bundles the strongest device settings into one switch. You’ll find it at Settings > Security & Privacy > Advanced Protection, and you need a screen lock set first.
According to Google, it makes Play Protect mandatory, blocks apps from unknown sources, restricts accessibility tools, enables Theft Detection Lock and a 72-hour inactivity reboot, adds USB protection, blocks 2G connections on supported devices, turns on scam detection and enforces HTTPS. You can also turn on optional, encrypted intrusion logging.
Forensic tools and expert help
Amnesty International’s Security Lab released the Mobile Verification Toolkit (MVT) in July 2021 during the Pegasus Project. It looks for traces of sophisticated spyware on Android and iOS.
MVT’s own documentation says it’s built for technical users with forensic experience and isn’t intended for self-assessment by end users. If you think you’re targeted, work with a specialist instead. Apple points threat-notification recipients to the Access Now Digital Security Helpline, which runs 24/7.
SIM Swap Protection: Lock Down Your Phone Number
Your phone number is often the key to your other accounts, so protecting it is part of protecting your phone.
The FCC adopted rules on November 15, 2023, that target SIM swap and port-out fraud. Carriers must use secure methods to confirm it’s really you before moving your number to a new device or provider. They must also notify you right away when someone requests a SIM change or port-out on your account. You can read the FCC’s summary of the SIM swapping rules.
What you can do today:
- Ask your carrier about account protections, such as a port-out lock or number lock and an account PIN that’s different from your phone passcode.
- Act on carrier alerts immediately. If you get a SIM change notice you didn’t request, call your carrier from another phone.
- Move important logins off SMS codes where you can. Authenticator apps, passkeys and security keys don’t depend on your phone number.
- Turn on Stolen Device Protection on iPhone (iOS 17.3 or later). Away from familiar places, it requires Face ID or Touch ID for sensitive actions and adds a one-hour security delay before changes like a new Apple Account password.
How to Protect Your Phone From Hackers Going Forward
Prevention is mostly about a few habits. The FTC’s own advice for protecting your phone covers the basics: lock it with at least a 6-digit passcode, update your software, back up your data and turn on the feature that finds a lost phone.
Build on those basics with this list:
- Update quickly. OS updates often include critical security patches. Turn on automatic updates for the system and your apps.
- Use the official app store only. Check reviews, the developer name and the permissions an app asks for.
- Give apps the least access they need. Choose “While using the app” or “Ask every time” for location, and deny camera and microphone access unless a feature needs it.
- Use a password manager so every account gets a unique password.
- Turn on two-factor authentication, and prefer passkeys or authenticator apps to SMS.
- Don’t tap links in unexpected messages. Go to the company’s app or website directly instead.
- Keep your phone physically secure. Don’t share your passcode, and don’t leave your phone unlocked around people you don’t trust.
- Avoid jailbreaking or rooting, which strips away built-in protections.
- Be careful on public Wi-Fi. Prefer mobile data for banking, or use a trusted VPN on networks you don’t control.
- Look ahead. Encryption is evolving too. Our guide to post-quantum cryptography explains why long-term protections are changing.
| Setting | iPhone | Android |
|---|---|---|
| Review who can see your data | Safety Check | Privacy dashboard |
| Track app access to sensors | App Privacy Report | Privacy dashboard |
| Scan apps for malware | App Store review (no user scan) | Play Protect |
| Block camera/mic instantly | Revoke per app in Settings | Quick Settings camera and mic toggles |
| Protect against theft | Stolen Device Protection | Theft Detection Lock |
| Maximum protection mode | Lockdown Mode | Advanced Protection |
| Check management profiles | VPN & Device Management | Device admin apps |
Mistakes That Make a Hacked Phone Worse
People under stress often make the problem bigger. Avoid these common slips.
- Changing passwords on the infected phone. If a keylogger or screen-reading app is present, it sees the new passwords. Use a clean device.
- Tapping “fix it” pop-ups. Fake security warnings exist to make you install the actual malware or pay for useless software.
- Paying for a “hacker check” from a stranger. Services that offer to “hack back” or recover accounts for a fee are a common scam.
- Restoring a full backup right after a reset. You may bring the problem straight back.
- Wiping the phone when stalkerware is likely. You could alert the person watching you and lose evidence.
- Ignoring a SIM change alert. By the time you check, your email and bank resets may already be underway.
- Relying on a dial code. A clean *#21# result says nothing about spyware.
- Forgetting linked devices. A tablet, laptop or smartwatch on the same account can keep leaking data after you clean the phone.
A 10-Minute Monthly Phone Security Checkup
Make this a habit on the first day of each month. It catches most problems early, long before obvious symptoms appear.
- Install any pending OS and app updates.
- Scroll your full app list and delete anything you don’t use or recognize.
- Check camera, microphone and location permissions.
- Open App Privacy Report (iPhone) or the Privacy dashboard (Android) and look for surprises.
- Review signed-in devices on your Apple Account or Google Account.
- Check VPN & Device Management (iPhone) or device admin apps (Android).
- Run a Play Protect scan or your phone maker’s scanner.
- Look at your email forwarding rules and connected apps.
- Glance at your carrier bill and bank statement for odd charges.
- Confirm your recovery email and phone number are still yours.
| Check | Time | Catches |
|---|---|---|
| App list and permissions | 3 min | Fake apps, spyware, over-permissioned apps |
| Privacy report or dashboard | 2 min | Hidden camera, mic and location use |
| Account devices | 2 min | Account takeover |
| Profiles and admin apps | 1 min | Management and stalkerware tricks |
| Bills and statements | 2 min | Fraud and premium charges |
Frequently Asked Questions: How to Know If Your Phone Is Hacked
Not by itself. *#21# shows whether your calls are being forwarded to another number, and ##21# turns that forwarding off. It can reveal one trick attackers use to intercept calls and voice codes, but it can’t detect malware or spyware. Use it alongside the settings checks in this guide.
Yes. On iPhone, run Safety Check, turn on App Privacy Report and look in VPN & Device Management for profiles. On Android, run a Play Protect scan, open the Privacy dashboard and review accessibility and device admin apps. On both, check the device list on your Apple Account or Google Account.
A number alone usually isn’t enough to install malware on an up-to-date phone. The bigger risk is a SIM swap, where a criminal convinces your carrier to move your number to their SIM and then receives your text codes. Ask your carrier about a port-out lock and move key logins to an authenticator app or passkey.
Often, yes. If the problem is one bad app, a profile or a compromised account, removing the app, deleting the profile and securing your accounts from a clean device can be enough. Reset only if symptoms continue, and avoid restoring a full backup afterwards.
A restart can interrupt some malicious processes and is a sensible first step, but it rarely removes an installed app or profile. It also does nothing for a hacked account. Treat a restart as a quick test, not a fix.
iPhones normally install apps only from the App Store, which limits classic malware, while Android allows sideloading and powerful permissions that malware can abuse. Both can still fall to phishing, account takeover, SIM swaps and targeted spyware. Your habits matter more than the logo on the back.
Look for new fingerprints or face profiles, apps or profiles you didn’t add, devices on your account you don’t own, and people knowing your location or conversations without being told. If you suspect a partner or family member, get support from a domestic violence advocate before removing anything.
Spyware or a malicious app with permission can use them. That’s why iPhone shows an orange or green dot and Android shows a green indicator whenever the microphone or camera is active. Check which app is responsible and remove its access in your privacy settings.
The Bottom Line
Most phone problems that feel like a hack turn out to be an old battery, a heavy app or a compromised password rather than spyware. That’s good news, because accounts are easier to fix than devices.
To know if your phone is hacked, look for several changes you didn’t cause, then confirm them with the built-in tools: Safety Check and App Privacy Report on iPhone, Play Protect and the Privacy dashboard on Android, plus your account’s device list on both.
If you find real evidence, cut the connection, secure your email and main account from a clean device, remove what doesn’t belong and reset only if you need to. If you’re at higher risk, turn on Lockdown Mode or Advanced Protection and get expert help.
Finally, put the 10-minute monthly checkup on your calendar. It’s the simplest way to spot trouble early and keep your phone, and everything on it, under your control.
