To check whether your phone is hacked, look for unauthorized activity, review apps and permissions, and inspect your account security not just battery drain. Android malware scans and iPhone privacy checks can help investigate, but neither a clean scan nor a dial code guarantees safety. This guide also explains how location data affects AI recommendations, so useful personalization is not mistaken for surveillance.
Safety first: If someone controlling or abusive may be monitoring you, use another trusted device to seek help before changing settings. Removing stalkerware or stopping location sharing could alert that person and escalate the situation. A domestic violence advocate can help you plan safely and preserve evidence. (consumer.ftc.gov)
How do you know your phone is hacked?
The strongest warning signs are actions you did not authorize: messages sent from your accounts, unfamiliar signed-in devices, changed security settings, or an app identified as harmful. Slow performance, heat, and battery drain deserve investigation, but do not establish hacking by themselves. For example, Apple notes that background work after an update can temporarily affect battery life and temperature.
Think in terms of evidence rather than counting symptoms. An unfamiliar app combined with unexplained access to sensitive permissions deserves closer attention than a warm phone alone. Start with these checks:
Persistent pop-ups or redirects: Note whether they occur only on one website or continue elsewhere. Never install a supposed security fix advertised by the warning itself.
Apps you cannot explain: Review the installed-app list, not just the home screen. Investigate the app’s purpose before deciding whether it belongs.
Messages you did not send: Check the account’s signed-in devices as well as the phone; unauthorized account access needs investigation too.
Security warnings: Open the account’s settings directly to investigate unfamiliar activity rather than trusting an unexpected message. (support.google.com)
Battery, data, and sensor activity need context
Review battery usage by app and compare it with what you actually used. Check cellular data consumption for unexplained activity, too. Treat a change as a reason to investigate, not a verdict: the useful question is which app or process explains it. Apple’s battery tools distinguish background activity from onscreen use.
Camera or microphone indicators are another prompt to check permissions. On iPhone, a green indicator means the camera, or camera and microphone together, is being used; microphone-only use has an orange indicator. Review which app was responsible and whether its access matched something you were doing.
How can I check if my phone is hacked?
Check the device and its connected accounts separately: inspect installed apps, review sensitive permissions, use the platform’s security tools, and examine unfamiliar account sessions. These checks help distinguish a suspicious app from account misuse or an ordinary performance problem. Menu names vary by device and software version, so use Settings search when a path differs.
On Android: scan apps and inspect permissions
Start with Google Play Protect, then examine what apps can access:
Open Google Play Store. Tap your profile picture, then Play Protect. Run a scan and keep app scanning enabled.
Review installed apps. In Settings, open the app list and investigate anything you do not recognize, especially apps installed outside Google Play.
Open the privacy dashboard. Search Settings for Privacy dashboard, then inspect location, camera, and microphone activity.
Match access to purpose. Ask whether each app needs that permission for a feature you use. Restrict unnecessary access and investigate unexplained activity.
Play Protect can warn about, disable, or remove potentially harmful apps. A clean result is reassuring, but not proof that every threat is absent; security software can miss malware. If suspicious behavior persists, consult the manufacturer instead of repeatedly downloading unfamiliar “cleaner” apps.
On iPhone: review sharing and device management
An iPhone security app cannot freely inspect every other app or the entire operating system. Apple’s sandboxing restricts third-party apps’ access to other apps and system resources. Be skeptical of promises that an App Store download can perform an unrestricted, complete spyware scan.
Instead, work through these built-in checks:
Privacy & Security: Review camera, microphone, photos, contacts, and location permissions. Remove access that is unnecessary.
Safety Check: On supported iPhones, open Settings > Privacy & Security > Safety Check to review sharing with people and apps, and connected account access.
VPN & Device Management: Under Settings > General, inspect configuration profiles. An unfamiliar profile warrants investigation, but work or school management may be legitimate; confirm before removing it.
Review account access independently
If you are wondering how to check whether your phone is hacked, do not stop at the handset. In your Google or Apple account, review devices and sharing access. For Google, compare unfamiliar sessions by device, browser, time, and location, then sign out sessions you cannot explain.
A location mismatch alone is not enough to identify an intruder. Google explains that account activity may show a nearby place rather than your exact location, and background communication can affect timestamps. Assess the whole session rather than one city name.
Location privacy and AI recommendations
Geographical information, or GEO data, deserves special attention during a phone security review. Location access can support legitimate AI recommendations, while location sharing also needs careful control. The key distinction is whether you understand and authorize how that information is being used. (support.google.com)
A local AI answer is not proof of hacking
An AI assistant suggesting a nearby coffee shop does not automatically mean someone has compromised your phone. Google says Gemini can use a general area inferred from your IP address or saved Home and Work addresses. With permission, it can also process precise device location, and connected services such as Maps may supply location for a request.
That distinction matters when investigating an unexpectedly accurate answer. First ask where the assistant obtained its location context. Then review the assistant’s permissions, connected services, and saved account information rather than assuming the recommendation proves surveillance.
Use enough geographical context not more than needed
For better AI recommendations with less unnecessary disclosure, try these practical boundaries:
Name a broad area: Ask for suggestions “in downtown Denver” rather than supplying your home address when neighborhood-level results are sufficient.
Reserve precision for proximity: Consider precise location for a genuinely nearby search, then review whether continued access is necessary.
Check connected services: An assistant’s own permission switch may not explain every source of location context.
Review saved conversations: Place names included in prompts or responses may remain in chat history; use the service’s activity controls when needed.
Separately, review people who can see your location. On iPhone, Safety Check can help examine sharing access; on Android, the privacy dashboard helps identify apps using location permissions. These are different checks: app access and sharing with another person should both be understood.
Can dial codes check whether your phone is hacked?
No. Call-forwarding codes check a network feature, not whether your phone contains malware or spyware. They may help investigate unexpected call diversion, but cannot provide a general hacked-or-not verdict. Confirm supported codes with your carrier before using them, because instructions differ across networks and services.
For example, Vodafone UK documents *#21# for checking unconditional forwarding and *#61# for checking unanswered-call forwarding. These are carrier-specific examples, not universal instructions for US subscribers. T-Mobile publishes its own forwarding controls, illustrating why your provider’s documentation should take priority over a viral checklist.
Ask your carrier to explain an unfamiliar forwarding destination before changing it. Do not confuse checking forwarding status with disabling forwarding, and do not treat either result as a malware scan.
If your phone unexpectedly loses service and you receive notice that your SIM was activated elsewhere, contact your carrier immediately from another device. A SIM-swap scam can hijack your number without installing malware on your phone.
Take action when evidence points to compromise
Prioritize personal safety, then account protection and device cleanup. If malware is suspected, stop entering passwords or banking details on the phone while investigating. Use a trusted device for sensitive recovery tasks, and seek support if you cannot establish a safe way forward.
Preserve relevant evidence. Record suspicious apps, messages, alerts, and account changes before deleting or resetting anything, particularly if abuse may be involved.
Secure affected accounts. Change compromised passwords, enable two-factor authentication, and remove unfamiliar sessions. Start with accounts showing unauthorized activity.
Update and clean the device. Install available security updates and, when safe, remove apps you do not trust. Follow the platform’s removal guidance.
Escalate persistent problems. Ask the manufacturer or a trusted security professional for help if warnings or unexplained behavior continue.
If a reset becomes necessary, preserve essential personal content first. Avoid automatically restoring every old app: the FTC warns that reinstalling apps from a backup could reinstall stalkerware. Download needed apps afresh from the official store and secure any accounts the suspected attacker could access.
For a verified Apple mercenary-spyware threat notification, seek specialist assistance rather than relying on routine symptom checks. Apple describes these as high-confidence targeting alerts and recommends taking them seriously. Its guidance also covers Lockdown Mode for people who have reason to believe they face this kind of targeted attack.
Build habits that make future checks easier
Keep automatic updates enabled where available, install apps from trusted official sources, and periodically remove software you no longer need. Revisit permissions after adding an app that requests location, microphone, or camera access. Knowing what normally belongs on your phone makes an unfamiliar app or unexpected permission easier to investigate.
Protect your mobile account as well. Ask your carrier about an account PIN or password, and consider an authentication app or security key for sensitive accounts rather than relying only on text messages. The FTC recommends these alternatives because SIM swapping can expose SMS verification codes.
If you decide to compare mobile phones, make security support and understandable privacy controls part of your checklist. Do not assume browsing the latest mobile phones is the first recovery step: account security, sharing access, and careful app restoration still need attention when replacing a device.
The takeaway: investigate access, not just symptoms
The practical answer to how to check your phone for hacking is to work through apps, permissions, accounts, and location sharing methodically. Treat performance changes as clues, not proof, and treat local AI recommendations as a reason to understand location settings not panic. When evidence persists, get trusted help rather than accepting a clean scan or dial code as an all-clear.
