How to tell if your Android is hacked

AndroidUpdated

Google lists the signs of harmful software on Android as pop-ups that won't go away, a phone that's slow or short of space, messages your contacts got that you didn't send, and Google signing you out to protect your device. To check, run Google Play Protect, review your apps and permissions, and look at the devices signed in to your Google Account.

Quick answer

Open the Play Store, tap your profile icon, then Play Protect, and make sure scanning is on. Uninstall apps you don't trust, update the phone, and run Google's Security Checkup at myaccount.google.com/security-checkup. Check your Google Account's device list for anything unfamiliar. If signs continue, Google says you may need to reset the phone.

What are the signs an Android phone is hacked?

Google and Samsung list similar signs. None proves a hack on its own, since slow phones and short battery life have ordinary causes too. The more specific signs are activity you didn't do: messages, calls, apps or account changes you don't recognise.

From Google:

  1. Google signed you out of your account to protect your device.
  2. Pop-up ads that won't go away, or messages about a virus.
  3. The phone is very slow, has less free space than before, or doesn't work properly.
  4. Your contacts get emails or messages from you that you didn't send.

From Samsung, for Galaxy phones:

  1. Calls or texts you didn't make, which you can see in the Phone and Messages apps.
  2. Apps you don't recognise, especially ones with random letters for a name.
  3. Unusually high data use, which you can check at Settings > Connections > Data usage.
  4. A battery that drains fast, or needing to charge often.

How do I check my Android with Google Play Protect?

Google Play Protect checks your apps and device for harmful behaviour. It checks Play Store apps before you download them, scans for harmful apps from other sources, warns you about them, and may disable or remove them. It's on by default, and Google recommends keeping it on.

  1. Open the Play Store app.
  2. Tap your profile icon, then Play Protect, then Settings.
  3. Make sure Scan apps with Play Protect is on.
  4. If you've installed apps from outside the Play Store, also turn on Improve harmful app detection.

To check your phone is Play Protect certified, go to Play Store > profile icon > Settings > About.

On a Samsung Galaxy, Samsung also offers a scan at Settings > Security and privacy > App security > App protection > Scan phone. Samsung says this isn't available on every model or network.

How do I remove apps I don't trust?

Google's advice is to uninstall any app you don't need, don't trust or didn't get from the Play Store. On a Galaxy, Samsung suggests doing this in Safe mode, which stops third-party apps from running while you remove them.

  1. Go to Settings > Apps and tap See all apps.
  2. Tap any app you don't need, don't trust or don't recognise.
  3. Tap Uninstall.

Menu names vary between phone makers and Android versions, so your phone's wording may differ slightly.

How do I check app permissions and device admin apps?

Harmful apps need access to work, so it's worth seeing which apps hold sensitive permissions. Android lets you review permissions by app or by type. Samsung also suggests checking the list of device admin apps, which can have special permissions.

  1. To review by type, go to Settings > Security and privacy > Privacy > Permission manager, choose a permission such as Camera, Microphone or Location, and see which apps have it.
  2. To review one app, go to Settings > Apps, choose the app, and tap Permissions.
  3. On a Samsung phone, open Settings, tap the search field and type Device admin apps to see which apps are listed there. On a phone your employer gave you, ask your IT team before changing anything.

Google Play's policy says apps that aren't accessibility tools, and it names monitoring apps as an example, must show you an in-app disclosure and get your consent before using Android's accessibility features. So an app you don't recognise holding that access is one to look into.

Google notes some of these steps need Android 11 or later on Pixel phones.

How do I check my Google Account for devices I don't know?

Your Google Account lists the devices you're signed in on now or were signed in on in the last few weeks. Google lists unfamiliar devices and unexpected security events as signs of suspicious activity. A device you don't recognise may still be yours, for example a shared computer or a phone you recently reset.

  1. Go to myaccount.google.com and tap Security & sign-in.
  2. Under Your devices, select Manage all devices.
  3. Tap any device you don't recognise, then Sign out. If several sessions share a name, sign out of all of them.
  4. Change your Google Account password, and any other account that uses the same password.
  5. Turn on 2-Step Verification.
  6. Run Security Checkup at myaccount.google.com/security-checkup. It reviews your recovery phone and email, 2-Step Verification, third-party apps with access to your account, and screen locks on your devices.

What should I do if the signs don't go away?

Update first, then reset if you have to. Google says that if you still see signs of harmful software after its steps, you may need to reset the phone or ask the manufacturer for help. The NCSC says phones usually can't be fixed by antivirus the way computers can, so a factory reset is the safest option.

  1. Install any update at Settings > System > Software updates, and security updates at Settings > Security & privacy > System & updates.
  2. Back up what you need, then factory reset the phone from Settings.
  3. Restore only from a backup made before the trouble started. The NCSC warns that rescuing data from a still infected phone risks carrying the infection over.
  4. If problems continue after the reset, Samsung suggests a Samsung service centre for Galaxy phones, and the NCSC suggests expert help.

Where Failshot fits

Failshot doesn't detect hacking, malware, spyware or remote access, and it won't tell you whether your Android has been hacked. Use Play Protect and the checks above for that. Failshot covers one thing: someone with your phone in their hands.

On Android, Failshot photographs whoever unlocks your phone while Failshot is on, and it also photographs a wrong PIN, pattern or password at the real lock screen. The camera light shows whenever it takes a photo.

Switching Failshot off needs your fingerprint or face, or your own Failshot PIN plus your answer, never the phone's PIN. So someone who knows your PIN can't switch it off, and a wrong Failshot PIN takes another photo. Photos stay on your phone, with optional email alerts that send the photo and the time. Failshot is for your own device only, and it's coming soon to Android.

Questions people also ask

Does Android have a built-in virus scanner?

Android has Google Play Protect, which Google describes as checking your apps and device for harmful behaviour. It checks apps from the Play Store before you download them, scans for harmful apps from other sources, and may disable or remove them. Check it's on at Play Store > profile icon > Play Protect > Settings.

How do I know if my Samsung phone is hacked?

Samsung lists pop-up ads, calls or texts you didn't make, unfamiliar apps, unusually high data use and fast battery drain. It suggests scanning at Settings > Security and privacy > App security > App protection, removing suspicious apps in Safe mode, and a factory reset if problems continue.

Can I see if someone else is using my Google Account?

Yes. Go to myaccount.google.com, tap Security & sign-in, then Manage all devices under Your devices. It shows devices signed in now or in the last few weeks. Sign out of any you don't recognise and change your password.

What is Auto Blocker on Samsung?

Auto Blocker is a Samsung security setting at Settings > Security and privacy > Auto Blocker. Samsung recommends turning it on if you think your phone has been compromised, and says you can also turn on Maximum restrictions, though this limits some features.

Sources