How to tell if your phone is hacked, and what to do about it

Search this question and you will find long lists of "warning signs" that describe almost every phone more than two years old. A phone that runs warm, drains quickly or has slowed down is far more likely to have a tired battery, a misbehaving app or a pending update than a hacker inside it. Strange noises on calls and random pop-ups in a web browser are similar: mostly network glitches and aggressive ad sites.

Notice that the strongest signs are often about your accounts rather than the handset. A criminal who has your Google or Apple password, or your email, can do most of the damage without ever touching your phone.

iPhones are hard to infect with traditional malware because every app runs in its own sandbox and apps come from the App Store. The realistic risks are someone with your passcode, a profile you were talked into installing, and a compromised Apple Account.

1. Profiles and device management. Go to Settings > General > VPN & Device Management. On a personal phone this is often empty. A profile you do not recognize can route your traffic or control settings. Tap it to see who issued it and remove it if it is not from your employer or school.
2. Apple Account devices. Tap your name at the top of Settings and scroll to the device list. Remove any phone, Mac or browser you do not own.
3. Safety Check. On iOS 16 and later, Settings > Privacy & Security > Safety Check shows who you share location, photos and other data with, and which apps have access to what. Its Emergency Reset option cuts off all sharing at once.
4. Apps. Scroll through your App Library for anything you do not remember installing.

Android allows more flexibility, including installing apps from outside the Play Store. That flexibility is the route most Android malware takes. Menu names vary between Samsung, Google Pixel and other makers, so use the search bar at the top of Settings if a path below does not match.

1. Accessibility services. Open Settings > Accessibility and look at the installed services. Accessibility access lets an app read your screen and tap on your behalf. Banking trojans and stalkerware abuse it heavily. A flashlight or cleaner app has no business here.
2. Device admin apps. Search Settings for "device admin." Admin rights can stop an app from being uninstalled. Revoke them for anything unexpected, then uninstall it.
3. Google Play Protect. Open the Play Store, tap your profile picture, then Play Protect, and run a scan. Make sure scanning is turned on.
4. Install unknown apps. Search Settings for "install unknown apps" and turn the permission off for your browser, messaging apps and file managers unless you have a specific reason.
5. Google account devices. Run the Google Security Checkup and sign out any device you do not recognize.

Watch for emails saying your password was changed or a new device signed in, friends receiving messages you did not send, two-factor codes arriving that you did not request, and changed recovery email addresses or phone numbers in your account settings.

A SIM swap is when a criminal convinces your carrier to move your number to a SIM card they control. Your phone suddenly shows no service or "SOS only" in a place where it normally works, and soon after, codes sent by text go to them. If that happens, use another phone or Wi-Fi calling to contact your carrier immediately, then secure your email and bank.

1. Update the phone. Install the latest iOS or Android version and security patch. Many attacks rely on flaws that updates close. See how to keep your devices updated.
2. Remove what does not belong. Delete unfamiliar apps, revoke accessibility and admin access you did not grant on purpose, and remove unknown profiles.
3. Secure your main account from a device you trust. Change your Apple Account or Google password, then your email password if it is different. Turn on two-factor authentication. Check the recovery phone number and email are yours.
4. Change other passwords that matter. Banking, shopping, social media. If you reused a password anywhere, change it everywhere. A password manager makes this bearable, and you can check if a password has leaked.
5. Factory reset as a last resort. If problems persist after all of the above, back up your photos and contacts, then erase the phone and set it up again. Reinstall apps from the store one at a time rather than restoring a full backup that might bring the problem back.

If money left your accounts or someone opened accounts in your name, follow our guide on what to do if your identity is stolen and report it at IdentityTheft.gov.

Stalkerware is monitoring software installed by someone with physical access to your phone: a partner, an ex, occasionally a family member. It can share your location, messages and photos. On iPhones the more common route is a known passcode or shared Apple Account rather than an installed app.

Removing it can tip off the person who installed it, and in an abusive relationship that can escalate the danger. Before you change anything, consider talking to an advocate. The National Domestic Violence Hotline (1-800-799-7233) can help with safety planning, and the Coalition Against Stalkerware has guidance for survivors. Research this on a device the other person cannot access, such as a library computer or a friend's phone.

When you are ready, iPhone's Safety Check and the Android checks above are the starting points. Changing your passcode and your Apple or Google password from a safe device cuts off a lot of access by itself.

For most people, no. Google Play Protect scans Android apps for free, and iPhones do not let any app inspect other apps at all, so iPhone "antivirus" apps mostly offer web filtering, scam-link warnings and breach alerts. We explain the limits in do Macs and iPhones need antivirus.

On Android, a paid app can add a second malware scanner and stronger scam-site blocking. That may help someone who installs a lot of apps or a relative who clicks every link in a text. If you already pay for a suite such as Bitdefender on your computer, check whether your plan includes the mobile app before buying anything separately. No app replaces the account steps above.