How to Check If Your Phone Is Hacked: 12 Signs to Know

Learning how to check if phone is hacked starts with knowing what to look for — and staying calm. A hot battery or a weird pop-up does not automatically mean you have been hacked. Most of the time, these symptoms have boring explanations like an aging battery, a buggy app update, or a misbehaving setting. But a hacked phone is a real possibility, and knowing the difference matters, because your phone holds your banking apps, your email, your photos, and the keys to nearly every account you own.

This guide walks you through the warning signs, shows you exactly where to look on both iPhone and Android, and gives you a clear 30-minute action plan if something looks wrong. It is based on guidance from US consumer-protection and cybersecurity agencies, not scare tactics.

How to Check if Phone Is Hacked: 12 Warning Signs

No single symptom proves a hack. Look for a pattern — two or three of these together is when you should take action.

1. Your battery drains much faster than usual. Malicious software running in the background consumes power. If your battery life suddenly drops without a settings change or major update, dig deeper. (An old battery degrades gradually — a sudden cliff is the red flag.)
2. The phone runs hot when you are not using it. A warm phone during gaming is normal. A phone that feels hot while sitting idle on a table is not.
3. Your mobile data usage spikes for no reason. Spyware and malware send stolen data back to criminals, which shows up as unexplained data consumption. Check your data usage by app in your phone’s settings.
4. Apps appear that you never installed. This is one of the strongest warning signs. Unknown apps — especially ones with generic names or blank icons — deserve immediate suspicion.
5. Pop-ups and browser redirects, even outside the browser. Aggressive adware can push pop-ups onto your home screen or hijack links. On iPhones, this is rare and usually points to a malicious website or profile rather than a true hack.
6. Calls or texts you did not send. If your call log or messaging apps show activity you do not recognize, someone may be using your number — or your accounts.
7. Friends tell you they got strange messages from you. Spam sent from your accounts is a classic sign that an account (email, social media, messaging) has been compromised, even if the phone itself is clean.
8. Settings change on their own. Disabled security features, changed passwords, or new “device administrator” apps you did not approve are serious red flags.
9. Unfamiliar charges on your phone bill or bank statements. Premium-rate calls, texts, or small test charges criminals use to check stolen card numbers often appear first.
10. Your phone is sluggish, crashes, or restarts randomly. Malware competes for your phone’s resources. On its own this usually means an old phone or a bad update — combined with other signs, it matters more.
11. The camera or microphone indicator appears when you are not using them. Both iPhone and Android show a dot or icon when the camera or mic is active. If it lights up with no app visibly running, investigate which app triggered it.
12. You cannot power off or restart the phone normally. Rare, but some malware tries to block shutdowns to stay active. If your power button suddenly “stops working,” be suspicious.

Important reality check: after a major software update, phones often run hot and drain the battery for a day or two while the system reindexes files. Give it 48 hours before concluding the worst.

How to Check if Your iPhone Is Hacked

iPhones are harder to hack than most people think. Apple’s sandboxed design means apps cannot freely scan or modify the system, which is also why no App Store “antivirus” app can do a deep system scan. Real iPhone compromises almost always come through phishing, malicious configuration profiles, or a compromised Apple ID — not a virus in the traditional sense.

Here is where to look:

• Settings > Battery: Scroll down to see battery usage by app. Look for unfamiliar apps with high “Background Activity.”
• Settings > General > VPN & Device Management: If you see a configuration profile you did not install (especially from an employer you do not have), remove it. Profiles can reroute traffic and install certificates.
• App Library: Swipe through every page. Malware sometimes hides off the home screen.
• Settings > [Your Name] > Devices: Check the list of devices signed in to your Apple ID. Remove anything you do not recognize.
• Safari: If pop-ups plague you, check Settings > Safari for unknown extensions, and clear website data.

If everything above is clean, your iPhone itself is very likely fine — shift your attention to your accounts (email, Apple ID, banking), which is where the real damage usually happens.

How to Check if Your Android Phone Is Hacked

Android gives apps more freedom than iOS, which means more to check — but also better built-in tools for the job.

• Settings > Apps: Review the full app list, including system apps. Uninstall anything unfamiliar. Pay attention to apps with vague names like “System Update” or “Phone Booster” that you did not install.
• Google Play Protect: Open the Play Store, tap your profile icon, then Play Protect, and run a scan. It is built in and free.
• Settings > Battery > Battery usage: Look for unknown apps consuming large amounts of power in the background.
• Settings > Security > Device admin apps (location varies by manufacturer): Remove admin privileges from any app you do not recognize before uninstalling it — admin apps can block their own removal.
• Check for sideloaded apps: In Settings > Apps > Special app access > Install unknown apps, see which apps are allowed to install others. If a random app has this permission, revoke it.
• Review Google account sessions: Visit your Google account’s device and security activity pages from a computer to spot unfamiliar logins.

What to Do in the First 30 Minutes

If the signs point to a real compromise, work quickly but in the right order. The goal is to cut the attacker’s access before they can do more damage.

1. Turn on airplane mode. This immediately stops data from leaving your phone and prevents remote commands from reaching it. It does not delete anything.
2. Grab a different, clean device — a laptop, a tablet, a family member’s phone. Do your password resets there, not on the possibly compromised phone, in case a keylogger is capturing keystrokes.
3. Change your email password first. Your email is the master key: password resets for everything else flow through it. Use a strong, unique password.
4. Change banking and financial app passwords next, then your Apple ID or Google account password.
5. Turn on two-factor authentication (2FA) everywhere important, using an authenticator app rather than SMS codes where possible. SMS-based codes can be intercepted in SIM-swap attacks.
6. Call your mobile carrier. Ask them to add a SIM PIN or an account PIN, and ask whether anyone has recently requested a SIM change or a number port on your line. This is your defense against SIM swapping, where a criminal convinces your carrier to move your number to their phone.
7. Review active sessions. In your Google, Apple, and social media account settings, sign out all other sessions and devices.
8. Check your bank and card statements for transactions you do not recognize, and report anything suspicious immediately.

Report It and Lock Down Your Identity

Once the immediate bleeding is stopped, make it official and protect your credit:

• Report the fraud to the FTC at ReportFraud.ftc.gov. The Federal Trade Commission uses consumer reports to build cases against scammers and track fraud trends. If the incident involved identity theft specifically, IdentityTheft.gov will walk you through a personalized recovery plan.
• Place a free credit freeze with all three credit bureaus — Equifax, Experian, and TransUnion. Under the federal law that made freezes free, you must contact each bureau separately, and freezes requested online or by phone must be placed within one business day. A freeze blocks new credit accounts from being opened in your name, and you can lift it temporarily (within one hour of an online or phone request) whenever you legitimately apply for credit. The Consumer Financial Protection Bureau explains how to place a free credit freeze step by step.
• Consider a fraud alert as a lighter alternative: you only need to contact one bureau, which notifies the other two, and it lasts one year.
• File a police report if money was stolen — your bank or credit card company may require the report number for a fraud claim.

What Does NOT Work: 5 Myths About Phone Hacking

1. “An antivirus app will find and remove it.”

On iPhone, this is a myth by design: Apple’s sandboxing means no App Store app can scan the entire system the way desktop antivirus does. Any iPhone “virus scanner” claiming otherwise is misleading you. On Android, Google Play Protect is a reasonable built-in scanner, but it cannot fix a compromised account or a SIM swap.

2. “A factory reset fixes everything.”

A factory reset wipes apps and data, which removes most common malware from the device itself. But it does absolutely nothing about compromised passwords, a hijacked email account, or a SIM swap — the attacker simply logs back in. Change your passwords from a clean device before you reset, and be careful about restoring from a backup made while the phone was compromised.

3. “I should just get a new phone number.”

Changing your number is disruptive and rarely necessary. It does not revoke an attacker’s access to your email, bank, or cloud accounts. Fix the accounts first; change the number only if harassment continues.

4. “Deleting the weird app is enough.”

It is a good step, but incomplete on its own. Check for configuration profiles (iPhone) or device-admin apps (Android) the malware may have left behind, and still change your important passwords.

5. “Hackers only target important people.”

Most phone attacks are automated and opportunistic — phishing texts, malicious ads, and fake apps are blasted out to millions. You do not need to be interesting to be targeted; you just need to click.

How to Keep Your Phone Secure Going Forward

Prevention is less dramatic than recovery, and far more effective. These practices line up with CISA’s mobile security guidance:

• Install updates promptly — for both the operating system and your apps. Most updates patch security holes attackers actively exploit.
• Use a password manager and phishing-resistant login methods. Authenticator apps or hardware security keys beat SMS codes, which can be intercepted.
• Set a PIN on your carrier account to block unauthorized SIM changes.
• Use end-to-end encrypted messaging (such as Signal) for sensitive conversations.
• Review app permissions regularly. A flashlight app does not need your location, microphone, or contacts. On iPhone, consider iCloud Private Relay; both platforms let you restrict camera, mic, and location access per app.
• Download apps only from the official App Store or Google Play, and be skeptical of apps with few reviews or vague descriptions.

Cyber threats are not only a personal problem — they regularly drive national responses, from federal cybersecurity directives to carrier-level fraud crackdowns. But the single most effective defense remains unglamorous: updated software, unique passwords, and a few minutes of healthy skepticism before you tap a link.

Frequently Asked Questions