Stalkerware: how to tell if someone is spying on your phone, and what to do safely

The Coalition Against Stalkerware, a group of security companies and domestic violence organizations, describes stalkerware as tools that "enable someone to secretly spy on another person's private life via their mobile device." It can expose messages, photos, location, calls and web searches, and it runs hidden in the background.

It is usually installed by someone who has had the unlocked phone in their hands, even briefly. On iPhones, much of the same spying is done without any app, by signing in to the victim's Apple Account or switching on iCloud Backup and reading it from elsewhere. Shared location, a shared family account or a saved password can do the job just as well.

• Emergency: 911.
• National Domestic Violence Hotline: 800-799-7233, text START to 88788, or chat on its website. The site warns that internet use can be monitored and is impossible to erase completely, so use a safer device to visit it.
• If you may want to report it, the Coalition suggests getting help from law enforcement before removing anything.

Keep a simple log of what you notice: dates, what the person knew, and how they could have known it. Patterns help advocates and police.

The Coalition's detection and removal guide says "the most common sign that your activity is being monitored will be because of the abuser's changes in behavior." Watch for someone who:

• quotes your messages or knows about conversations they were not part of;
• turns up where you are without being told;
• knows what you searched for or which sites you visited;
• insists on having your passcode or handling your phone.

Device symptoms, such as a battery that drains quickly, unexplained data use, a rise in Screen Time or strange notifications, can point to stalkerware, but the Coalition notes that some stalkerware shows none of these, and plenty of innocent things cause them. Our guide to how to tell if your phone is hacked covers the general warning signs.

1. iCloud Backup. The Coalition notes that some stalkerware pulls data from iCloud backups. Open Settings, tap your name, then your device, and check whether iCloud Backup is on. If you did not turn it on, someone else may have.
2. Your Apple Account. In Settings, your name, scroll to the list of devices signed in to your account. Any device you do not recognize is a red flag.
3. Safety Check (iOS 16 and later, in Settings, Privacy and Security). Apple says Manage Sharing and Access lets you review, person by person and app by app, what you share, and Emergency Reset stops all sharing at once and lets you review emergency contacts, devices and your password (Apple Personal Safety guide). Reviewing is quiet; stopping sharing is a change the other person may notice.
4. Profiles. In Settings, General, VPN and Device Management, look for a configuration profile you did not install, unless the phone belongs to your employer or school.

1. Apps from outside the Play Store. Stalkerware on Android is typically sideloaded, the Coalition says. Look through Settings, Apps (including system apps) for anything you do not recognize, especially with names like "System Service" or "Sync".
2. Device admin and accessibility. In Settings, search for Device admin apps and for Accessibility. Spy apps often grant themselves these powerful permissions.
3. Google Play Protect. Open the Play Store, tap your profile, then Play Protect, and run a scan.
4. Your Google Account. At myaccount.google.com, Security, check the devices signed in and any third-party access.

A reputable antivirus app can detect most stalkerware, according to the Coalition, whose members include security companies offering free scanners. Scanning is another change an abuser could notice, so do it as part of your plan.

When it is safe to act, the Coalition ranks the options:

1. A new phone is the best option. Some survivor programs provide phones.
2. A factory reset is "almost as effective." Back up photos and contacts first, then reinstall only the apps you need rather than restoring a full backup.
3. Antivirus removal of what it finds.

Then change the locks:

• A new passcode the person cannot guess, and a screen that locks after about 30 seconds. Stalkerware usually needs physical access to an unlocked phone.
• New passwords for your Apple or Google account and email, set from a safe device, with two-factor authentication on (how to set it up).
• Remove unknown devices from your accounts, and check location sharing in Find My, Google Maps, Snapchat and Life360.
• Check for physical trackers too: AirTags and other trackers.

Our iPhone and Android settings guides cover the rest. More in the devices hub.