A slow phone, a warm battery or an unexpected pop-up does not automatically mean that your phone has been hacked. These problems can also be caused by an aging battery, a faulty app, limited storage, poor reception or a recent software update.
More convincing warning signs include an unknown device connected to your Apple or Google Account, security information changed without permission, messages or purchases you did not make, or an unfamiliar app with powerful permissions.
This guide shows how to check an iPhone or Android phone safely, which signs deserve immediate attention and what to do if you find something suspicious.
Quick Answer: Signs That Deserve Attention
| Stronger warning signs | Unknown account logins, unfamiliar connected devices, changed passwords or recovery details, unauthorized purchases, messages sent without you, unknown apps or management profiles |
| Possible but inconclusive clues | Battery drain, overheating, high data use, crashes, slowness, pop-ups or reduced storage |
| First place to check | Your Apple Account or Google Account security activity and connected devices |
| Android security scan | Google Play Protect |
| iPhone sharing review | Safety Check on supported iPhones |
| Emergency response | Use a trusted device to change passwords, remove unknown access and contact relevant providers |
What Does “My Phone Was Hacked” Actually Mean?
The phrase can describe several different problems:
- Someone gained access to your Apple Account or Google Account.
- An unauthorized person knows your phone passcode.
- A harmful or deceptive application was installed.
- An app was given excessive access to messages, notifications, location or other information.
- Your mobile number was transferred or changed without permission.
- A social media, email or banking account was compromised even though the phone itself was not.
Identifying the type of problem matters because deleting an app will not secure a stolen email password, and changing an email password will not remove an unwanted device-management profile.
1. Check for Unknown Account Activity First
Your Apple Account or Google Account controls important information such as backups, photographs, email, saved passwords, contacts, purchases and connected devices.
Unknown account activity is generally more meaningful than ordinary performance problems.
Check an iPhone for unknown Apple devices
- Open Settings.
- Tap your name at the top.
- Scroll down to view devices connected to your Apple Account.
- Tap each device you do not immediately recognize.
- Compare its model and other available details with devices you own.
You can also review your account through Apple’s official website:
Do not remove a device merely because its displayed name looks slightly different. An old phone, tablet, computer, television or family device may still be legitimately connected.
Remove a device when you are confident that it does not belong to you or should no longer have access.
Check an Android phone for unknown Google devices
- Open the Settings app.
- Tap Google or open your Google Account.
- Select Manage your Google Account.
- Open the Security tab.
- Review Recent security activity.
- Review Your devices or Manage all devices.
You can also use Google’s official Security Checkup:
Look for unfamiliar phones, computers, browsers, locations or sign-in times. Remember that mobile-network locations and IP-based locations can sometimes be approximate.
Important account warning signs
- Your password no longer works even though you did not change it.
- Your recovery email address or telephone number was modified.
- You receive a security alert for a login you did not make.
- A new verification method or trusted device appears.
- Emails, messages or files have been deleted or changed.
- Purchases or subscriptions appear that you did not authorize.
- Friends receive messages that you did not send.
If you recently clicked a questionable message or entered information on an unfamiliar page, follow this guide as well:
What to Do After Clicking a Suspicious Link on iPhone or Android
2. Review Recently Installed Applications
An unfamiliar application deserves investigation, especially if it appeared after opening a download link, allowing someone to use your phone or installing software outside the normal app store.
On an iPhone
- Swipe left through your Home Screen pages until you reach the App Library.
- Use the search box to review the complete alphabetical app list.
- Look for applications you do not remember installing.
- Open Settings → General → iPhone Storage for another full list.
Do not delete an application solely because its name is unfamiliar. Search for the developer and confirm whether the app belongs to your bank, employer, mobile provider, connected accessory or another legitimate service.
On Android
The exact menu varies between Samsung, Google Pixel, Motorola and other manufacturers, but the usual route is:
- Open Settings.
- Select Apps.
- Open the complete application list.
- Sort by recently installed or recently used when that option is available.
- Investigate applications you do not recognize.
Pay particular attention to apps installed shortly before the suspicious behavior began.
3. Run Google Play Protect on Android
Google Play Protect checks applications for potentially harmful behavior. It can examine apps obtained through Google Play and can also provide protection relating to apps installed from other sources.
To run a scan:
- Open the Google Play Store.
- Tap your profile picture.
- Select Play Protect.
- Tap Scan.
- Follow any official warning or removal instructions.
You can read Google’s official instructions here:
Keep Play Protect enabled. Do not install a random “phone cleaner,” “virus remover” or “hacker detector” advertised through a pop-up. A deceptive security app can create an additional problem instead of solving the original one.
4. Check iPhone Configuration Profiles
Configuration profiles can be used legitimately by employers, schools, VPN providers and organizations to control certain settings. An unexpected profile can also deserve investigation because device management may provide significant control.
To check:
- Open Settings.
- Tap General.
- Tap VPN & Device Management.
- Review any listed profiles or management services.
If that section does not show any profiles, no device-management profile is currently installed.
Do not remove a work or school profile without understanding the consequences. Removing a legitimate profile may also remove associated settings, applications, access or organizational data.
When a profile is unfamiliar, contact the organization or service named in the profile before deciding whether to delete it.
5. Review Powerful App Permissions
An application does not need complete control of a phone to create a privacy problem. It may instead have permission to access sensitive information.
Important permissions to review
- Camera
- Microphone
- Location
- Photos and videos
- Contacts
- Calendar
- Bluetooth or nearby devices
- Notifications
- Accessibility services
- Device administration
- Installation of unknown applications
On iPhone
Open Settings → Privacy & Security and examine the relevant permission categories. Remove access when an application has no reasonable need for that information.
For example, a navigation app may reasonably need location access, but a basic calculator probably does not.
On Android
Open Settings → Privacy, Security and privacy or Permission manager. The wording varies by manufacturer and Android version.
Also review special access such as:
- Accessibility access
- Notification access
- Display over other apps
- Install unknown apps
- Device administrator apps
These permissions can be legitimate, but an unfamiliar app should not normally have powerful access without a clear reason.
6. Use Safety Check on a Supported iPhone
Safety Check helps an iPhone user review sharing, connected people, app access and account security. It is available on supported iPhones running iOS 16 or later.
To find it:
- Open Settings.
- Tap Privacy & Security.
- Scroll down and tap Safety Check.
The available options include reviewing sharing and access or using an emergency reset.
Read Apple’s official explanation before making major changes:
If you believe a partner, family member or another person may be monitoring your device, changing access can sometimes alert that person. Consider using a different trusted device to seek assistance and plan changes safely.
7. Check for Unauthorized Messages, Calls and Purchases
Review areas where an attacker might leave clearer evidence:
- Sent email folders
- Recently deleted email
- Text and messaging conversations
- Social media login history
- App Store or Google Play purchases
- Bank and payment-app transactions
- New subscriptions
- Password-reset emails
- Mobile-provider account changes
A spam call or message does not itself mean that your phone has been compromised. Telephone numbers are frequently obtained through data leaks, marketing databases, automated dialing or random number generation.
Use this separate guide to reduce unwanted contact:
How to Stop Spam Calls and Texts on iPhone and Android
8. Look for Mobile-Provider or SIM Changes
Contact your mobile provider promptly when:
- Your phone suddenly loses cellular service for no clear reason.
- You receive notice that a SIM or eSIM was activated.
- Your provider password, PIN or email address was changed.
- Calls or messages appear to be redirected.
- Your mobile account contains an unknown device or line.
A service outage or faulty SIM can also cause lost reception, so loss of signal alone is not proof of an attack.
Ask the provider to review recent account changes and protect the account with an appropriate PIN or other available security feature.
9. Treat Battery Drain and Overheating as Clues, Not Proof
Unusual battery consumption can result from:
- A recently installed or updated application
- Background location use
- Poor mobile reception
- High screen brightness
- Video streaming or gaming
- An aging battery
- A software update completing background work
Check which apps are using the battery before assuming malicious activity.
For step-by-step instructions, read:
How to Find What Is Draining Your Phone Battery
An unknown application consuming large amounts of power or background data deserves attention, but battery use alone cannot establish that a phone was hacked.
10. What to Do If You Find Something Suspicious
Step 1: Use a trusted device when possible
If you think the phone may be monitored, use another trusted phone or computer to secure your accounts.
Step 2: Change the affected password
Create a strong, unique password that is not used on another website. Start with the main email account because it may be used to reset many other passwords.
Step 3: Remove unknown devices and sessions
Sign out devices, browsers and applications that you do not recognize. Review recovery email addresses, telephone numbers and trusted verification methods.
Step 4: Enable stronger sign-in protection
Turn on two-factor authentication or another stronger method offered by the service. Save recovery information in a secure location.
Step 5: Remove suspicious apps or profiles
Delete only items you have identified as unauthorized. Take screenshots first when you may need evidence for a bank, employer, mobile provider, police report or personal-safety situation.
Step 6: Update the operating system and apps
Install updates through the official iPhone Settings app, Android Settings app, App Store or Google Play Store.
Step 7: Contact affected organizations
Contact your bank, payment provider, email provider, mobile carrier or employer when their accounts or information may be involved.
Step 8: Consider a factory reset only when necessary
A factory reset may help remove persistent unwanted software, but it erases the phone and should not be the first response to every unexplained problem.
Before resetting:
- Secure the associated online accounts.
- Save important photographs and documents.
- Record evidence of unauthorized activity.
- Confirm that you know the Apple or Google account credentials needed after the reset.
- Avoid automatically reinstalling an app that caused the problem.
A factory reset does not secure an online account whose password remains compromised.
Official Account-Recovery Resources
Use the official provider pages rather than paying an unknown “account recovery expert.”
No legitimate support agent should ask you to reveal a verification code, recovery code, complete password or device passcode.
What Not to Do
- Do not assume that every battery or performance problem is hacking.
- Do not install security software from a pop-up advertisement.
- Do not pay an unknown person who promises guaranteed account recovery.
- Do not give anyone a verification code sent to your phone.
- Do not reuse the compromised password on another account.
- Do not erase important evidence before documenting it.
- Do not remove legitimate work or school management without checking first.
Frequently Asked Questions
Can someone hack my phone just by calling me?
Receiving an ordinary phone call is not evidence that your phone has been hacked. Be cautious when a caller asks for passwords, verification codes, payments, remote-access software or account information.
Does fast battery drain mean that spyware is installed?
No. Battery drain has many common causes. Review battery usage, installed apps, account activity and permissions before drawing a conclusion.
Can an iPhone get harmful software?
No connected device should be treated as automatically immune from security problems. Keep iOS updated, review your Apple Account, avoid unknown profiles and install software only through trusted sources.
How can I scan an Android phone?
Open Google Play Store, tap your profile image, select Play Protect and run a scan. Also review installed apps, permissions, account activity and software updates.
Should I change every password?
Prioritize the affected email, Apple Account or Google Account and any account using the same or a similar password. Every important account should have its own unique password.
Will changing my password remove malicious software?
No. A password change can protect an online account, but it does not automatically remove a harmful app, configuration profile or unauthorized device setting.
Will a factory reset fix everything?
Not necessarily. It may remove software stored on the phone, but it will not fix compromised email, cloud, banking, mobile-provider or social media accounts unless those accounts are also secured.
Final Security Checklist
- Review Apple or Google account activity.
- Remove connected devices you do not recognize.
- Check recently installed applications.
- Run Google Play Protect on Android.
- Review iPhone profiles and device management.
- Check sensitive app permissions.
- Change compromised passwords using a trusted device.
- Enable stronger sign-in protection.
- Install official operating-system and app updates.
- Contact your bank or mobile carrier when relevant.
- Document serious unauthorized activity before deleting evidence.
This guide provides general security information. Phone menus vary by model, operating-system version and manufacturer. For suspected financial fraud, stalking, identity theft or immediate personal danger, contact the appropriate provider or local authority using a trusted device.