How to tell if your phone is hacked (iPhone and Android)

Most phones that feel "hacked" are not running spyware. Far more often, someone has got into an account the phone is signed in to, or an app has more access than you realized. The official guides from Apple, Google and the FTC point to the same free checks and you can do all of them in Settings.

How can you tell if your phone is hacked?

Look for signs in two places: the phone itself and the accounts on it. On the phone, check for apps you did not install, unknown device management profiles, and sudden changes in battery, data or stability. On your accounts, check for sign-ins, devices and settings changes you did not make. If both look clean, your phone is very likely fine.

Real signs, from official sources

Signs on the phone. The FTC's stalkerware guide lists battery draining faster than usual, using more data than expected, and the phone overheating or restarting unexpectedly. Its malware guide adds a device that slows down, freezes or crashes, lots of pop-up ads, and messages sent from your accounts that you did not write.

Signs in your accounts. Apple's page on a compromised Apple Account lists:

• A notification or email about activity you do not recognize, like a sign-in on a new device or a password change
• A two-factor authentication code you did not ask for
• Messages you did not send, items deleted that you did not delete, or trusted devices you did not add
• Purchases you do not recognize
• Your password no longer working
• Your device locked or put in Lost Mode by someone else

Google's hacked account page adds unfamiliar changes to your recovery phone, recovery email, name, apps with access to your account, and 2-Step Verification or Location Sharing being turned on or off.

Signs from people around you. The FTC flags a specific one: someone knows where you are, who you talk to or which sites you visit, and they have had your phone in their hands before.

Signs of a SIM swap. If your phone suddenly loses all service, or your carrier tells you your SIM was activated on a new device, the FTC's SIM swap alert says to contact your carrier right away. That is an attack on your phone number, not the phone.

Myths to ignore

• One sign on its own is not proof. A hot phone, a battery that drains faster or a slow day can have everyday causes. Treat them as a reason to run the checks below, not as a verdict.
• Dial codes. Searches for an "is my phone hacked check code" are common. None of the Apple, Google or FTC pages we checked mention a code that tells you whether a phone is hacked, so do not rely on one.
• Paid "hack scanner" apps you found from a scary pop-up. The FTC lists lots of pop-up ads as a sign of malware itself. Use the free checks built into your phone.

Check your apps

iPhone. Apple's review and delete apps guide gives the quickest way to see everything: swipe left past all your Home Screen pages to App Library, then tap the search field. You get an alphabetized list of every app on the device. If you do not know what an app is, look it up in the App Store.

Android. Open the Google Play Store, tap your profile icon, then Manage apps & devices and Manage to see installed apps. Then check Play Protect, which Google says is on by default: profile icon, Play Protect, then Settings, and make sure Scan apps with Play Protect is on. According to Google's Play Protect page, it checks apps when you install them, scans the device from time to time, and can warn about, disable or remove harmful apps.

Check for profiles and device management on iPhone

Go to Settings > General > VPN & Device Management. Apple's configuration profile guide says it plainly: if you do not see any profiles there, no device management profiles are installed.

If you see one, ask whether it belongs. Schools and employers use profiles and mobile device management to manage phones, and Apple says these tools can give access to data or location. If the phone came from work or school, check with the administrator before deleting anything. If you have no idea where the profile came from, our guide on removing a hacker from your phone covers what to do next. For the work side, see can my employer see my personal phone.

Run Safety Check on iPhone

Safety Check is the best single place to look on an iPhone with iOS 16 or later. Go to Settings > Privacy & Security > Safety Check. Apple's Safety Check guide says it needs an Apple Account with two-factor authentication.

Choose Manage Sharing & Access to review, one by one:

• Which people you share information with, including your location
• Which apps have access to your information, such as your location
• Devices connected to your Apple Account
• Phone numbers used to verify your identity

Emergency Reset is the other option. It stops sharing with all people and apps at once. If you feel unsafe, read the note at the end of this post before you use it. Every Safety Check screen also has a Quick Exit button that closes Settings right away.

Safety Check does not cover non-Apple accounts, social media, or devices signed in to a different Apple Account, so do the account checks below too.

Check your Google account on Android

Open your Google Account, tap Security & sign-in, and look at two panels:

1. Recent security events. Select Review security events. If anything was not you, select No, it wasn't me and follow the steps.
2. Your devices. Select Manage all devices. Google's devices page explains that you may see several sessions for one phone, that the time shown is the last time the device talked to Google, and that a phone you reset can still appear.

Then run Security Checkup from Recommended actions. Google's account security page says a green shield means no immediate action is needed.

Check the accounts behind the phone

Your phone is only as safe as the email account that resets everything else. If someone controls your inbox, they can reset your Apple or Google password, your banking app and your social accounts. Our guide on how to tell if your email has been hacked shows where to check sign-ins and hidden forwarding rules in Gmail, Outlook and Yahoo. Apple also suggests asking your carrier whether SMS forwarding has been set up on your number.

Lockdown Mode, for the few who need it

If you are a journalist, activist or someone else who could be personally targeted, Apple offers Lockdown Mode. Apple's Lockdown Mode page calls it "an optional, extreme protection" for "the very few individuals" who might be targeted, and adds that "Most people are never targeted by attacks of this nature." It blocks most message attachments and link previews, and stops new configuration profiles from being installed. Turn it on in Settings > Privacy & Security > Lockdown Mode.

On the Google side, the same group can look at the Advanced Protection Program, which Google suggests for journalists, activists and others at risk of targeted attacks.

If you think someone close to you is watching

If you suspect a partner or family member installed something, the FTC says to plan for safety before you remove it, because the person may notice. The National Domestic Violence Hotline is at 1-800-799-SAFE (7233), at thehotline.org, or by texting START to 88788.

Make your next leak easier to trace

A lot of account takeovers start with an email address that leaked from some site. If you use Secria Mail, you can give each site its own email alias. When phishing starts arriving at one alias, you know which site it came from, and deleting the alias stops it. Sign-up is a name, the address you want and a password, with no phone number. Create a free account if that is useful.

Frequently asked questions

Can you check if your phone is hacked in Settings for free?

Yes. On iPhone, check App Library, Settings > General > VPN & Device Management and Safety Check. On Android, check installed apps, Play Protect and your Google Account's devices and security events. None of it costs anything.

Is there a code to check if my phone is hacked?

None of the Apple, Google or FTC guides we checked mention one. Use the Settings checks above instead.

Can an iPhone be hacked?

Apple's own pages treat it as possible, which is why Safety Check, the compromised account guide and Lockdown Mode exist. In practice, Apple's list of warning signs is mostly about your Apple Account, not the phone itself.

What does it mean if my phone suddenly has no service?

It can be a simple outage. If it comes with a carrier message that your SIM was activated on another device, the FTC says to contact your carrier immediately, since that points to a SIM swap.

Does two-factor authentication stop phone hackers?

It stops someone who only has your password. Our post on whether two-factor authentication is safe covers which methods hold up best.

If the checks turn something up, work through how to remove a hacker from your phone. If they come back clean, keep automatic updates on and move on.