How to Check If Your Phone Is Hacked (Android and iPhone)

Your phone stores banking apps, private chats, photos and OTPs, which makes it the single most valuable target for hackers. So if your device has been acting strange lately and you want to check if your phone is hacked, this guide covers everything in one place. I have explained the warning signs, the built-in security checks for both Android and iPhone and even forensic tools to check spyware. On that note, let's begin.

Common Signs That Your Phone is Hacked

Before running any checks on your phone, look for these red flags. Note that a single symptom doesn't confirm a hack. A poor battery or an old phone can also cause similar issues. But if several of these signs show up together, it's time to investigate.

• Battery draining fast: Spyware runs constantly in the background and sends your data to a remote server, which consumes the battery. If your phone suddenly drains much faster than before without any change in usage, something fishy may be running behind the scenes. You should anyway check the battery health of your Android phone.
• Phone heating up when idle: Malicious processes keep the chipset busy even when the screen is off. If your phone feels warm while sitting untouched on a table, take it seriously.
• Data usage spikes: Spyware needs mobile data to send your messages, photos and location to the attacker. Go through your data usage stats and look for unfamiliar apps consuming large amounts of data.
• Apps you never installed: Hackers disguise spyware with generic names like "System Service" or "Device Health". If you spot an app you do not remember installing, that is a major red flag. Uninstall it immediately.
• Pop-ups outside the browser: Ads appearing on your home screen or over other apps point to an adware infection or a rogue app with dangerous permissions. You can see our guide on how to block ads on Android phones.
• Random restarts and sluggish performance: If your phone reboots on its own, freezes or crashes frequently, malware could be overloading system resources. Before assuming the worst, try a simple restart first. Check how to reboot an Android phone in our detailed guide.
• Activity you did not perform: If you see sent messages that you never wrote or unknown sign-in alerts or locked out of your account, these are signs of a compromise.

How to Check If Your Android Phone is Hacked

If you are running Android and want to check if your phone is hacked, the platform offers several built-in tools to hunt down malware and spyware. Here is how to use each one of them.

Run a Google Play Protect Scan

Google Play Protect is Android's built-in malware scanner and it checks all apps on your device, including sideloaded APKs. This is the best way to remove malware from your Android phone. Here is how to run a manual scan.

1. Open the Play Store on your Android phone and tap on your profile icon at the top right.
2. Next, choose Play Protect from the menu.
3. After that, tap on the Scan button and wait for the scan to finish.
4. If Play Protect flags a harmful app, tap on the prompt and hit Uninstall.

One more thing, if you find Play Protect turned off and you never disabled it yourself, treat that as a warning sign. Attackers switch it off so their spyware can work without being undetected.

Review Device Admin Apps

Spyware apps often take the Device admin permission to gain elevated access and block its own removal. Follow the steps below to review it.

1. Open Settings and go to Security. On some phones, it's under Apps > Special app access.
2. Here, tap on Device admin apps.
3. Now, go through the list carefully. Most personal phones should have almost nothing here apart from Find My Device or a work profile app.
4. If you see an unknown app, tap on it, turn off the toggle and then uninstall the app right away.

Check Accessibility Services and Data Usage

Some malicious apps abuse Accessibility permissions to read everything on your screen including passwords. You can follow our dedicated guide and disable Accessibility on Android, but here are the quick steps.

1. Head to Settings > Accessibility and scroll to the installed apps or downloaded services section.
2. Look for unfamiliar services with full access, turn them off and uninstall those apps.

3. Next, go to Settings > Network & internet > Mobile data usage. On some phones, head to Network & internet > SIMs > App data usage.
4. Sort apps by data usage and check any app you do not recognise sitting at the top of the list.
5. Now, uninstall those apps if you don't remember installing or using them.

Boot into Safe Mode

Safe mode is an isolated environment which loads the Android OS without any third-party apps. If your phone behaves normally in safe mode and doesn't show pop-up ads or exhibit heating or battery drain, a third-party app is the culprit. You can then uninstall suspicious apps on your Android phone one by one.

You can follow our guide on safe mode on Google Pixel and the steps are similar on most Android phones. Simply press and hold the Power + Volume up buttons together until the power menu appears. After that, press and hold the Power off or Restart menu on the screen. Now, tap on OK to reboot to Safe mode. And to turn off Safe mode on Android, follow our linked guide.

Update Android and Install Security Patches

Most Android malware don't use newly-discovered zero-day exploits. It exploits vulnerabilities that Google patched months ago on devices, but owners never installed the update. Android also offers two separate update streams so you should install both updates. Here is how to check both.

1. Open Settings and go to System > Software updates.
2. Here, tap on System update and hit Check for update.
3. Go back and tap on Google Play system update. This delivers Play services and core module patches directly from Google.

4. Install whatever update is pending and restart your phone.
5. Now open Settings > About phone and check the Android security update date.

If it's more than 4 to 6 months old, your phone has stopped receiving security patches. An unsupported phone can't be made safe no matter how carefully you use it. You should consider upgrading your phone. Apart from that, update your apps. Head to the Play Store > profile icon > Manage apps & device and tap on Update all. If you own a Google phone, here is how to update your Pixel device.

Format Your Android Phone

If you still feel your phone is hacked and the symptoms persist, a factory reset is your last resort. It erases everything on your phone, which removes hidden spyware as well. Follow our step-by-step guide to format Android phones, which covers the process across all major brands. If you own a Galaxy phone, go through our dedicated guide to reset a Samsung phone.

That said, go ahead and back up your Android phone before you format your phone. Make sure you back up only your photos, contacts and documents, but not your apps. An app backup will simply restore the malware. Bear in mind that if you want to keep evidence of spyware for later, don't reset the phone at all. A factory reset destroys the forensic traces that researchers use to confirm an infection.

How to Check If Your iPhone is Hacked

iPhones don't have a built-in virus scanner, so if you want to check if your phone is hacked on iOS, it comes down to reviewing a few key settings. Here are all the methods.

Run Safety Check

Safety Check is Apple's built-in security audit tool available on iOS 16 or later. Here is how to use it.

1. Open Settings and go to Privacy & Security.
2. Now, scroll down and tap on Safety Check.
3. Choose Manage Sharing & Access to begin the review.
4. Go through the people and apps that have access to your data and revoke anything suspicious.

Finally, review every device signed in to your Apple Account. If you spot a device you don't recognise, sign it out immediately and change your Apple Account password.

Inspect Configuration Profiles

Hackers use configuration profiles to install hidden permissions and certificates on iPhones. Here is how to remove them.

1. Open Settings and tap on General.
2. Next, scroll down and select VPN & Device Management.
3. Now, unless have you installed a VPN or your employer or school has enrolled your device, this section should be empty.
4. If you find a profile you don't recognise, tap on it and choose Remove Profile. That's it.

Look for Jailbreak Traces and Unknown Apps

If you see apps like Cydia or Sileo on your iPhone, someone has jailbroken your device, which disables Apple's security protections. Also, scroll through your full app library and remove anything you never installed.

Image Credit: Apple

Finally, keep an eye out for Apple's official threat notifications. Apple sends an email and iMessage alert if it detects a spyware attack on your account and the warning also appears when you sign in at account.apple.com.

Update Your iPhone

Most of the iPhone spyware infection documented by Citizen Lab and Amnesty has been found on a device running an outdated version of iOS. Apple quickly patches these exploits, but the patch only protects you once it's installed. Here is how to update your iPhone.

1. Open Settings > General > Software Update and install any pending update of iOS.
2. On the same screen, tap on Automatic Updates.
3. Here, turn on iOS Updates under both Automatically Download and Automatically Install.

Factory Reset Your iPhone

If your iPhone was jailbroken without your knowledge or the odd behaviour continues after you have cleared profiles and apps, wiping the device is the last fix. Head to Settings > General > Transfer or Reset iPhone > Erase All Content and Settings. You can go through our detailed guide to reset an iPhone, which also covers detailed methods for an iPhone that has become unresponsive.

Again, you should restore from a backup that was made before the infection began, otherwise the compromise may return along with your data. And if you are a journalist or activist who suspects spyware, don't reset and get the device examined first as erasing the phone wipes the evidence too.

Scan for Pegasus and Other Spyware Using Security Tools

While above methods can catch common malware and exploits, state-grade spyware like Pegasus, Predator and NoviSpy are built to evade normal antivirus apps and security checks. After the Pegasus Project in 2021, Amnesty International's Security Lab and the Citizen Lab published indicators of compromise and these tools let you check if your phone is hacked.

Mobile Verification Toolkit (MVT)

Mobile Verification Toolkit (MVT) is the gold standard to inspect hacked phones. It was developed by Amnesty International's Security Lab and released in July 2021 along with the Pegasus Project and it works on both Android and iPhone.

Unlike an antivirus, it doesn't run on your phone at all. It's a command-line tool for Linux and macOS that analyses a copy of your phone's data. It uses an encrypted iPhone backup or forensic data pulled from an Android phone via ADB. After that, the tool matches it against regularly updated indicators of compromise from known spyware campaigns.

Note that Amnesty calls MVT a forensic research tool, not a consumer app, and false positives happen. So if there is any detection, seek expert help before giving a final verdict. You can head over to mvt.re for the documentation and methodology.

iMazing Spyware Analyzer for iPhone

If the command line is not your thing, iMazing's desktop app for Mac and Windows brings MVT's detection tool in an easy-to-use interface. It checks for Pegasus, Predator, KingsPawn, Operation Triangulation, NoviSpy and more. The tool backs up your iPhone over USB, checks the backup against the same indicators and gives a readable report at the end.

Image Credit: iMazing

The best part is that the Spyware Analyzer is free to use in trial mode and the entire analysis runs locally, so none of your personal data leaves your computer. You can get the app from here.

iVerify Basic

iVerify is a user-friendly mobile app, which made headlines in 2024 when its Mobile Threat Hunting feature found seven Pegasus infections in its first 2,500 consumer scans. The victims included business leaders and government officials, not just journalists. The app works on both iOS and Android for a one-time fee of Rs 95.

Image Credit: iVerify

You run a scan once a month and it generates a diagnostic file from your crash logs and shutdown records, and iVerify's team gets back to you within hours. For regular users, it's the best tool to check if their phone is hacked. You can install iVerify Basic from the Play Store (Download) and App Store (Download).

What to Do If Your Phone is Hacked?

Before you seek expert help, I would recommend turning on these settings on your Android or iPhone to protect yourself.

Turn On Advanced Protection (Android)

Google shipped Advanced Protection with Android 16 for journalists, activists, lawyers and dissidents who face spyware attacks. Here is how to switch it on.

1. Open Settings and go to Security & privacy.
2. Here, Tap on Advanced Protection and enable the toggle next to Device Protection.
3. Now, reboot your Android phone.

Note that turning on Advanced Protection blocks app sideloading, disables 2G connectivity, blocks unencrypted Wi-Fi and enables Memory Tagging Extension on supported hardware.

Turn On Lockdown Mode (iPhone)

Apple has also built Lockdown Mode specifically for journalists, activists, lawyers and high-target individuals. It works by disabling features these exploits abuse. For instance, message attachments are blocked, link previews are disabled and certain web technologies are switched off in Safari. In addition, incoming FaceTime calls from strangers are rejected and wired connections to a computer are blocked while the phone is locked. Here is how to enable it.

1. Open Settings and tap on Privacy & Security.
2. Next, scroll to the bottom and select Lockdown Mode.
3. Tap on Turn On Lockdown Mode, then confirm and restart your iPhone.

And that is how you can check if your phone is hacked on Android and iOS. I would highly recommend not installing APKs from shady websites and stick to the Play Store and App Store. And don't click on suspicious links in a text message as these are most likely phishing attempts. Finally, if you believe you are being targeted by state-grade spyware, switch on Lockdown Mode or Advanced Protection on your phone.