Your phone is hacked if you notice unexplained battery drain, sudden spikes in data usage exceeding 2 to 5 GB above your baseline, unfamiliar apps you never installed, or random pop-ups appearing outside your browser. These 12 warning signs reveal whether someone has compromised your device, and the fixes below help you regain control within minutes.
12 Warning Signs Your Phone Is Hacked
Knowing how to know if your phone is hacked starts with recognizing patterns that deviate from normal device behaviour. A single symptom might indicate a software glitch, but three or more occurring together strongly suggest unauthorized access. The following signs apply to both Android and iOS devices, though the diagnostic steps differ by platform.
- Battery drains faster than usual. Spyware like Pegasus, mSpy, and FlexiSpy runs background processes that consume 15 to 40% more battery daily. On Android, check Settings > Battery > Battery Usage. On iPhone, go to Settings > Battery and review the app-by-app breakdown for unfamiliar entries.
- Data usage spikes without explanation. Malware exfiltrates photos, messages, and keystrokes to remote servers. A monthly increase of 2 GB or more above your typical usage pattern warrants investigation. On Android, check Settings > Network > Data Usage. On iPhone, go to Settings > Mobile Data and sort by consumption.
- Unfamiliar apps appear on your device. Stalkerware and trojans install companion apps with generic names like “System Service” or “Phone Manager.” Review your full app list monthly. On Android, check Settings > Apps > All Apps. On iPhone, scroll through Settings > General > iPhone Storage.
- Your phone overheats while idle. Cryptojacking malware and persistent spyware keep the CPU active at 60 to 90% utilization even when you are not using the device. A phone that feels warm in your pocket with the screen off is a strong indicator.
- Random pop-ups appear outside your browser. Adware infections generate overlay pop-ups at the system level. If you see ads when no browser or app is open, adware has embedded itself in your device. Common culprits include xHelper and Joker malware variants.
- Calls or texts you did not send appear in your logs. SIM-swapping attacks and remote access trojans (RATs) can make calls, send SMS messages, or initiate premium-rate text subscriptions from your number without your interaction.
- Your phone takes abnormally long to shut down or restart. Malware processes that resist termination delay the shutdown sequence by 30 seconds to several minutes as the operating system attempts to close rogue processes.
- Camera or microphone activates without your input. The green dot (iPhone) or green camera/orange microphone indicator (Android 12+) appearing when no app should be using these sensors indicates covert surveillance. Apps like Cerberus and some commercial stalkerware activate sensors silently.
- Accounts linked to your phone get compromised. If your email, social media, or banking apps report login attempts from unknown locations, an attacker may be harvesting credentials or session tokens directly from your device.
- Performance degrades noticeably. Apps that previously loaded in 1 to 2 seconds now take 5 to 8 seconds. Screen transitions stutter. The keyboard lags. Persistent malware consuming CPU and RAM causes system-wide slowdowns that factory apps alone cannot explain.
- Strange noises during phone calls. Clicking, static, distant voices, or echo patterns during calls can indicate call interception. While network issues occasionally cause this, consistent anomalies across different calls and locations suggest wiretapping software like FlexiSpy’s call recording module.
- Your phone restarts on its own. Remote access trojans trigger restarts to install updates, apply persistence mechanisms, or clear their operational traces. A phone that reboots more than once per week without a software update is suspicious.
How to Confirm Your Phone Has Been Compromised
Suspicion alone is not enough. You need concrete diagnostics to confirm unauthorized access before taking remediation steps. Start with these platform-specific checks that take less than ten minutes combined.
On Android, open Settings > Security > Device Admin Apps and revoke administrator privileges from any app you do not recognize. Then check Settings > Apps > Special Access > Install Unknown Apps to see which apps have sideloading permissions enabled. Next, run a scan with Malwarebytes Mobile Security (free tier detects most threats) or Bitdefender Mobile Security ($14.99/year, detects 99.6% of Android malware per AV-TEST 2025). Review the results for PUPs (potentially unwanted programs), trojans, and stalkerware detections.
On iPhone, check Settings > General > VPN & Device Management for any configuration profiles you did not install. Enterprise MDM profiles and custom VPN configurations are common attack vectors. Also check Settings > General > About > Certificate Trust Settings for unauthorized root certificates. If your iPhone is jailbroken without your knowledge (apps like Cydia, Sileo, or Zebra are present), assume full compromise. Use iVerify ($0.99) to scan for jailbreak indicators, known spyware signatures, and misconfigurations.
How to Remove Spyware from Your Phone: Step-by-Step Process
Once you confirm a compromise, speed matters. Every minute the malware remains active is another minute your data is being exfiltrated. Follow these steps in order, and do not skip the factory reset if you find confirmed spyware. Knowing how to remove spyware from your phone properly means eliminating all persistence mechanisms, not just the visible app.
Android Spyware Removal Steps
First, boot into Safe Mode by holding the power button, then long-pressing “Power Off” until the Safe Mode prompt appears. Safe Mode disables all third-party apps, including malware. While in Safe Mode, go to Settings > Apps and uninstall any app you do not recognize or did not install. Pay special attention to apps with generic names, no icon, or unusually large storage footprints (50 MB+ for a “system utility” is suspicious). Revoke Device Administrator permissions for all non-essential apps under Settings > Security > Device Admin Apps before attempting uninstallation, as malware often grants itself admin rights to resist deletion.
If the malware persists after manual removal, perform a factory reset. Go to Settings > System > Reset > Erase All Data. Before resetting, back up photos and contacts to Google Drive or a local computer, but do not restore app data from backup, as this can reintroduce the malware. After resetting, install Bitdefender Mobile Security or Norton Mobile Security ($29.99/year) before restoring any data.
iPhone Spyware Removal Steps
For iPhone, start by removing any suspicious configuration profiles under Settings > General > VPN & Device Management. Delete unknown VPN configurations and MDM profiles. Update to the latest iOS version immediately, as Apple patches known spyware exploits (the iOS 17.4 update patched three zero-day vulnerabilities exploited by commercial spyware). If you suspect Pegasus-level compromise, back up critical files manually, then perform a full restore through iTunes or Finder by selecting “Restore iPhone.” Do not restore from an iCloud backup, as sophisticated spyware can persist through backup restoration.
Best Phone Security Apps to Prevent Future Attacks
Removing the current threat is half the job. You need ongoing protection to prevent reinfection. The best phone security app for your situation depends on your platform, threat model, and budget. Here are the top options tested against real-world threats in 2025 and 2026 evaluations.
Bitdefender Mobile Security scores 100% malware detection on Android (AV-TEST, January 2026) and includes real-time scanning, web protection, VPN (200 MB/day free), and anti-theft features for $14.99/year. It runs with minimal battery impact, adding roughly 3 to 5% daily drain. For iPhone users, Bitdefender provides web protection, account privacy alerts, and VPN functionality.
Norton Mobile Security costs $29.99/year and delivers 100% Android malware detection, Wi-Fi security scanning, SMS/call filtering, and dark web monitoring for your personal data. The app advisor feature scans apps before you install them, flagging privacy risks and data collection practices. Norton consistently ranks among the top three mobile security solutions across independent testing labs.
Malwarebytes Mobile Security offers a strong free tier that handles on-demand scanning and stalkerware detection. The premium version ($3.33/month) adds real-time protection, phishing defense, and ad blocking. Malwarebytes excels at detecting PUPs and adware that other scanners miss.
How a Firewall Protects Your Phone from Network Attacks
Most phone hacks exploit network connections, whether through malicious Wi-Fi hotspots, compromised DNS servers, or man-in-the-middle attacks. Understanding what a firewall does helps you block unauthorized network traffic before it reaches your device. On Android, apps like NetGuard (free, open-source) and AFWall+ (requires root) provide per-app firewall rules that prevent suspicious apps from transmitting data. On iPhone, the built-in firewall is limited, but using a DNS filtering service like NextDNS or 1.1.1.1 with WARP blocks known malicious domains at the network level.
Enable your device’s built-in protections as a baseline. On Android, ensure Google Play Protect is active (Settings > Security > Google Play Protect). On iPhone, enable Lockdown Mode (Settings > Privacy & Security > Lockdown Mode) if you face targeted threats. Lockdown Mode disables message link previews, blocks most attachment types, restricts FaceTime calls to known contacts, and prevents configuration profile installation. Apple designed it specifically for journalists, activists, and high-risk individuals targeted by state-sponsored spyware.
Frequently Asked Questions
Can someone hack your phone through a text message?
Yes. Zero-click exploits delivered via SMS or iMessage can compromise your phone without you tapping anything. The Pegasus spyware used iMessage zero-click exploits to infiltrate iPhones running iOS 14 and 15. Keeping your operating system updated to the latest version patches known zero-click vulnerabilities. On Android, disable RCS and MMS auto-download in your messaging app settings.
Does a factory reset remove all phone hackers and spyware?
A factory reset removes approximately 95% of consumer-grade spyware and malware from both Android and iPhone. However, advanced persistent threats like Pegasus can survive resets on some devices by exploiting firmware-level vulnerabilities. After resetting, update your OS immediately, change all passwords from a separate clean device, and install a reputable security app before restoring any data.
How to know if your phone is hacked on iPhone specifically?
Check Settings > General > VPN & Device Management for unknown profiles, review Settings > Privacy & Security for apps with excessive permissions, and monitor battery usage for unfamiliar processes. Install iVerify ($0.99) to scan for jailbreak indicators and spyware signatures. Consistent overheating, unexplained data usage above 2 GB monthly, and random camera indicator activations are the strongest iPhone-specific indicators.