How to check if your iPhone is hacked

iPhoneUpdated

The quickest way to check an iPhone is with Apple's own tools. Safety Check shows which people, apps and devices have access to your information, your Apple Account lists every device signed in to it, and VPN & Device Management shows any configuration profiles. Then install the latest iOS update.

Quick answer

On iOS 16 or later, go to Settings > Privacy & Security > Safety Check to review who and what can reach your information. Then check Settings > [your name] for devices you don't recognise, and Settings > General > VPN & Device Management for profiles you didn't install. Finish with Settings > General > Software Update.

How do I use Safety Check on my iPhone?

Safety Check is built into iOS 16 and later. It reviews what you share with people, which apps can reach your information, the devices on your Apple Account and your account security settings. You need two-factor authentication on your Apple Account and to be signed in.

  1. Go to Settings > Privacy & Security > Safety Check. You may need to scroll down to find it.
  2. Choose Manage Sharing & Access to go through it step by step: sharing with people, then apps, then account items such as linked devices, verification phone numbers, your password and your passcode or Face ID settings.
  3. Or choose Emergency Reset, which immediately stops sharing with all people and apps and lets you review your emergency contacts, linked devices and verification phone numbers, and change your Apple Account password.
  4. If you need to leave quickly, tap Quick Exit in the top right. Settings closes and the changes you've already made are kept.

Apple notes that Safety Check doesn't cover non-Apple accounts, social media, or devices signed in to a different Apple Account.

How do I see which devices are signed in to my Apple Account?

Your Apple Account keeps a list of the devices signed in to it, and Apple's personal safety guide suggests removing any you don't recognise. It also suggests taking a screenshot of the list before you remove anything, for your records.

  1. Go to Settings > [your name] and scroll down to the list of devices.
  2. Tap any device you don't recognise, then tap Remove from Account.
  3. Change your password at Settings > [your name] > Sign-in & Security > Change Password.
  4. In Sign-in & Security, correct any phone number or email address you don't recognise, and make sure two-factor authentication is on.

How do I check for configuration profiles?

Configuration profiles can manage settings and other functions on an iPhone. Apple says that profiles, along with device management tools, may allow access to data or location information. Workplaces and schools use them legitimately, so check with your administrator before removing one from a work or school phone.

  1. Go to Settings > General > VPN & Device Management.
  2. If no profiles appear, none are installed.
  3. If you find one you didn't add, select it and tap Delete Profile, then follow the steps on screen.
  4. Restart the iPhone.

Deleting a profile also removes the settings, apps and data that came with it.

How do I check for apps I don't recognise?

App Library shows every app on your iPhone in one alphabetical list, including ones that aren't on your Home Screen. Go through it, look up anything unfamiliar in the App Store, and delete what you don't want.

  1. Swipe left past your last Home Screen page to reach App Library.
  2. Tap the search field to see an alphabetical list of every app.
  3. Touch and hold any app you want to remove, then tap Delete App.
  4. To review what each app can reach, such as your location or photos, use Safety Check on iOS 16 or later.

Why does updating my iPhone matter?

Updates are one of the steps the NCSC and Apple both list for securing a device. Apple includes keeping software up to date among the practices it recommends for everyone, and the NCSC recommends turning on automatic updates.

  1. Back up your iPhone with iCloud or a computer.
  2. Connect to power and Wi-Fi.
  3. Go to Settings > General > Software Update and tap Download and Install if an update is listed.
  4. To stay current, go to Settings > General > Software Update > Automatic Updates and turn on Automatically Install.

Should I turn on Lockdown Mode?

Probably not, unless you have reason to think you're a target. Apple describes Lockdown Mode as an optional, extreme protection for people who may face highly sophisticated attacks, such as spyware made by private companies for governments. Apple says most people are never targeted this way.

If you do need it, it's available in iOS 16 or later:

  1. Go to Settings > Privacy & Security > Lockdown Mode.
  2. Tap to turn it on, confirm, then restart and enter your passcode.

If Apple believes you've been individually targeted, it sends a threat notification. It appears on the Lock Screen and in Settings, by email from threat-notifications@email.apple.com, and as a banner when you sign in at account.apple.com. Apple says these notifications never ask you to click links, open files, install apps or profiles, or give your password.

What if someone knows my passcode?

Apple says anyone who knows your passcode can view and change the information on your device and Apple Account. Change it, and on iOS 17 or later, stop the old one working straight away.

  1. Go to Settings > Face ID & Passcode (or Touch ID & Passcode) and enter your passcode.
  2. Tap Change Passcode and set a new one.
  3. Tap Expire Previous Passcode, otherwise your old passcode can still reset it for 72 hours.
  4. If you think someone added a Face ID appearance, go to Settings > Face ID & Passcode > Reset Face ID and set it up again.
  5. On iOS 17.3 or later, consider Stolen Device Protection at Settings > Face ID & Passcode. Away from familiar places, it requires Face ID or Touch ID for actions such as viewing saved passwords, and adds an hour's delay before changes like a new Apple Account password.

Where Failshot fits

Failshot doesn't detect hacking, malware, spyware or remote access, and it can't tell you whether your iPhone has been hacked. Use Apple's tools above for that. Failshot covers one thing: someone with your iPhone in their hands.

Apple doesn't let any app see the Lock Screen or use the camera in the background. So on iPhone, you turn Failshot on and lock the phone, and whoever unlocks it lands in Failshot and is photographed. The camera light shows whenever it takes a photo. It doesn't photograph a wrong passcode at the iPhone Lock Screen.

Switching Failshot off needs Face ID or your own Failshot PIN plus your answer, never the iPhone passcode, so someone who knows your passcode can't switch it off. A wrong Failshot PIN takes another photo. Photos stay on your iPhone. Failshot is for your own device only, and it's coming soon to iPhone.

Questions people also ask

What is Safety Check on iPhone?

Safety Check is a tool in iOS 16 and later at Settings > Privacy & Security > Safety Check. It lets you review and stop what you share with people and apps, check the devices on your Apple Account, and change your password. Emergency Reset stops all sharing at once.

Can someone access my iPhone remotely?

Apple's personal safety guide suggests checking the devices signed in to your Apple Account under Settings > [your name] and removing any you don't recognise. Apple also lists configuration profiles as something that may allow access to data or location, so check VPN & Device Management.

How do I know if my Apple Account has been compromised?

Look for devices you don't recognise under Settings > [your name], and phone numbers or email addresses you didn't add in Sign-in & Security. If you find any, remove them, change your password and make sure two-factor authentication is on.

Will resetting my iPhone remove a hack?

The NCSC calls a factory reset the safest option for a phone that seems infected, followed by restoring from a backup made before the trouble began. If problems continue after the reset, it says to get expert help.

Sources