How to tell if your phone has been hacked

iPhoneAndroidUpdated

There is no single test that proves a phone has been hacked. Official guidance points to a set of signs: apps opening or closing on their own, pop-ups from apps you don't recognise, messages you didn't send, and account changes you didn't make. If you see them, check your accounts, update the phone and, if the problems carry on, reset it.

Quick answer

The UK's National Cyber Security Centre lists signs such as a phone that runs slowly, restarts by itself, opens or closes apps unexpectedly, or shows pop-ups from apps you don't know. For phones, it says antivirus usually can't fix an infection the way it can on a computer. The safest fix is a factory reset, then restoring from a clean backup.

What are the signs a phone has been hacked?

Signs fall into two groups: the phone behaving oddly, and your accounts doing things you didn't do. No single sign proves a hack, so look for several together, especially in your accounts.

Signs on the phone, from the NCSC, Google and Samsung:

  1. The phone runs slowly, restarts on its own, or opens and closes apps you aren't using.
  2. Pop-ups or messages about a virus that won't go away, from apps you don't recognise.
  3. Apps on the phone that you didn't download.
  4. Unusually high data use, or a battery that drains much faster than usual.
  5. On mobile, the NCSC notes that apps which check for rooting or jailbreaking can warn you if the phone has been rooted or jailbroken when you haven't done it yourself.

Signs in your accounts, from the NCSC and Google:

  1. You can't log in, or your security settings have changed.
  2. Your contacts get messages or emails from you that you didn't send.
  3. Logins from unfamiliar places or at odd times, or a device you don't recognise in your account's device list.
  4. Money spent or moved without your say-so.

How do I check an iPhone for signs of a hack?

Apple's own tools show who and what has access. Start with Safety Check (iOS 16 or later), then check profiles and apps, then update.

  1. Go to Settings > Privacy & Security > Safety Check to review which people and apps have access to your information, and which devices are signed in to your Apple Account.
  2. Go to Settings > [your name] and scroll to the device list. Tap any device you don't recognise, then Remove from Account.
  3. Go to Settings > General > VPN & Device Management. If nothing is listed, no profiles are installed. If you find one you didn't add, and the phone isn't from work or school, delete it.
  4. Swipe past your last Home Screen page to App Library and search to see every app on the phone.
  5. Go to Settings > General > Software Update and install anything waiting.

For the full walkthrough, see our guide on how to check if your iPhone is hacked.

How do I check an Android phone for signs of a hack?

Google Play Protect is built into Android phones with Google Play and checks your apps for harmful behaviour. Turn it on, remove apps you don't trust, update the phone and run Google's Security Checkup. Menu names vary between phone makers and Android versions.

  1. Open the Play Store, tap your profile icon, then Play Protect > Settings, and make sure Scan apps with Play Protect is on.
  2. Go to Settings > Apps > See all apps and uninstall anything you don't need, don't trust or didn't get from the Play Store.
  3. Go to Settings > System > Software updates and install any update.
  4. In a browser, go to myaccount.google.com/security-checkup and fix any issues it finds.

On a Samsung Galaxy, Samsung also suggests Settings > Security and privacy > App security > App protection > Scan phone, where your model and network offer it. There's more detail in our guide on how to tell if your Android is hacked.

What should I do if I think my phone has been hacked?

Secure your accounts first, then deal with the phone. The NCSC's order of work is to change passwords, sign out of other devices, turn on two-step verification and update everything. If the phone still misbehaves, factory reset it and restore only from a backup made before the trouble started.

  1. Change the password of any account you think is affected, and of any other account that uses the same password. Start with your email.
  2. Use each service's settings to log out of all devices and apps, so anyone else has to know the new password.
  3. Turn on two-step verification, starting with email and banking.
  4. Check your email for filters or forwarding rules you didn't create, and remove them.
  5. Install all software and app updates, and turn on automatic updates.
  6. If problems continue, factory reset the phone from Settings. The NCSC says phones usually can't be fixed by an antivirus product, and that rescuing data from a still infected device risks carrying the infection over.
  7. If you've lost money, tell your bank and report it to Report Fraud. In Scotland, call 101.

What if someone calls to say my phone is hacked?

Hang up. The NCSC says calls claiming your device is infected, with an offer to fix it, are a common scam, often from people claiming to be a well-known company. Report the call to Report Fraud, and if you've paid them anything, contact your bank or card provider.

What if I'm worried a partner or ex is watching my phone?

If someone close to you seems to know where you've been, what you've said in private or who you've been messaging, that can be a sign of stalkerware. The US Federal Trade Commission warns that removing it can alert the person who installed it. In the UK, the National Domestic Abuse Helpline is free on 0808 2000 247, and you can contact your local police.

Where Failshot fits

Failshot doesn't detect hacking, malware, spyware or remote access, and it won't tell you whether your phone has been hacked. It covers one thing: someone with your phone in their hands.

Failshot photographs whoever unlocks your phone while Failshot is on, and the camera light shows whenever it takes a photo. On iPhone, Apple doesn't let any app see the Lock Screen or use the camera in the background, so you turn Failshot on and lock the phone, and whoever unlocks it lands in Failshot and is photographed. It doesn't photograph a wrong passcode at the iPhone Lock Screen. On Android it also photographs a wrong PIN, pattern or password at the real lock screen.

Switching Failshot off needs Face ID, your fingerprint or face on Android, or your own Failshot PIN plus your answer, never the phone's passcode, so someone who knows your passcode can't switch it off. Photos stay on your phone. Failshot is for your own device only, and it's coming soon to iPhone and Android.

Questions people also ask

How do I know if my phone is hacked or it's just old?

Many signs, such as slowness, restarts and battery drain, have ordinary causes. The more specific signs are in your accounts: messages you didn't send, settings you didn't change, logins or devices you don't recognise. If you see those, follow the NCSC steps above.

Will a factory reset remove a hack?

For phones and tablets, the NCSC says a factory reset is the safest option, because antivirus usually can't fix them the way it can a computer. If the problem carries on after a reset, it says you'll need expert help. Restore from a backup made before the trouble began.

Can my phone be hacked by clicking a link?

Official guidance treats links in unexpected messages as a common route for scams and harmful software. Apple advises against opening links or attachments from unknown senders, and Samsung says not to click suspicious links. If you clicked one, change the password for any account you entered and run the checks above.

What does it mean if Apple sends me a threat notification?

Apple sends threat notifications to people it believes have been individually targeted by mercenary spyware. They appear on the Lock Screen, in Settings, by email and at account.apple.com. Apple says they never ask you to click links or install anything, and suggests Lockdown Mode and expert help.

Sources