Patrick Glennon leads technology and security at IDIQ. He has more than two decades of experience in banking and consumer identity protection with roles at JP Morgan Chase, CoreLogic, and Arthur Andersen.
Quick answer: One symptom alone does not prove your phone is hacked. Stronger evidence includes unfamiliar devices or sessions in your accounts, apps or settings you did not install, calls or texts you did not send, unauthorized purchases, and an unexpected loss of cellular service. Performance issues like battery drain, heat, and lag have many common non-malicious causes.
Check These First
Before working through the full list of signs, run these checks. If your phone may be actively compromised, use a trusted device — a friend’s phone or a computer you know is clean — for any account access.
- Apple Account or Google account: Sign in and review the list of devices and recent security events.
- Installed apps and profiles: Look for apps or configuration profiles you do not recognize.
- App permissions: Check which apps have access to your camera, microphone, location, and contacts.
- Carrier and SIM activity: Contact your carrier if you have lost cellular service unexpectedly or received a port or SIM change notification you did not request.
- Financial accounts: Review recent transactions for unauthorized charges or mobile banking activity you do not recognize.
Strong Signs vs. Possible Symptoms
Multiple related signals matter more than any single issue. Performance problems alone are rarely evidence of hacking.
Stronger evidence of compromise:
- Unfamiliar devices or active sessions in your Apple Account, Google, or email account
- Apps, profiles, or accessibility permissions you did not install or grant
- Calls, texts, emails, or social posts you did not send
- Unauthorized purchases, password reset emails, or verification codes arriving unexpectedly
- Sudden complete loss of cellular service or a SIM change notification you did not request
Possible symptoms with many common causes:
- Battery drain faster than usual (may be caused by background apps, aging battery, or new software)
- Phone running warm (common during charging, streaming, or heavy use)
- Slow performance or unexpected crashes (often caused by software updates or storage issues)
- Strange sounds during calls (usually network or hardware related)
- Unusual data usage (can result from app updates or sync activity)
10 Signs Your Phone May Be Compromised
These are the warning signs to watch for. Consider them alongside the strong vs. possible evidence framework above.
1. Unrecognized Account Logins, Devices, or Security Changes
Check the device list and recent security events in your Apple Account or Google account. An unfamiliar device, a sign-in from an unknown location, or a security setting change you did not make is among the strongest indicators of compromise. This is the first place to look.
2. Unknown Apps, Profiles, or Permissions
If you spot apps you do not recognize, remove them immediately — unless you have reason to believe someone with physical access to your device may be monitoring it, in which case see the stalkerware warning further in this article before taking any action. On iPhone, check for unknown configuration profiles in Settings. On Android, check device administrator apps and accessibility permissions. Hackers sometimes hide malicious software behind icons that look familiar.
3. Calls, Texts, or Posts You Did Not Send
If contacts report receiving messages from you that you did not send, or if you find calls or texts in your log that you did not make, your phone or an account linked to it may be compromised.
4. Unauthorized Purchases or Unexpected Verification Codes
Unexplained charges on a payment method linked to your phone, or verification and password reset codes arriving without you requesting them, are serious signals. Review your financial accounts and contact your bank or card issuer if you see anything unauthorized.
5. Sudden Loss of Cellular Service
If your phone abruptly loses service and a restart does not fix it, contact your carrier. This can be a sign of a SIM swap where your number has been transferred to a device under the attacker’s control.
6. Unexplained Camera, Microphone, or Location Activity
Review which apps have access to your camera, microphone, and location in your phone’s settings. If an app you do not recognize has permissions it should not need, revoke them and investigate the app. Both iOS and Android show indicators when these sensors are in use.
7. Persistent Pop-Ups or Browser Redirects
Pop-ups appearing when you are not using a browser, or your browser being redirected to sites you did not choose, can indicate adware. Do not tap anything in an unexpected pop-up. Run a security scan and review your installed apps and browser extensions.
8. Unusual Mobile Data Usage
A significant spike in mobile data you cannot account for may mean an app is transmitting data without your knowledge. Check your phone settings to see which apps are using the most data. Unfamiliar apps using large amounts of data in the background are worth investigating.
9. Battery Drain, Overheating, or Slow Performance
These are possible symptoms with many common causes, including aging batteries, software updates, and heavy app use. They are not proof of hacking on their own. If they appear alongside other stronger signs from this list, take them more seriously. Check which apps are consuming battery in your phone settings.
10. Repeated Crashes, Restarts, or Changed Settings
Frequent crashes or settings that change without explanation may indicate a software conflict, a problematic app, or in some cases malicious activity. Note: Claims that malware can actively prevent a phone from shutting down are not well documented and should not be treated as reliable indicators. Software crashes and restarts are more commonly caused by bugs or insufficient storage.
Why Phone Security Matters More Than Ever
A phone is not just a phone anymore. It holds your banking apps, private messages, photos, email, and the authentication codes that protect your other accounts. With so much personal data stored on one device, a single compromise can expose your financial accounts, identity, and security credentials.
According to a 2024 global survey by Appdome, over 40% of mobile phone users have either personally experienced mobile fraud, malware, or a cyberattack, or know someone who has. In the same survey, 58% said mobile fraud is their top security concern. A Kaspersky report found that smartphone attacks rose by 48% in the first half of 2025 compared to the prior six months.
Can Your Phone Really Be Hacked?
Yes. Smartphones are always connected through messages, cloud syncing, Bluetooth, and countless apps. The same connectivity we depend on creates entry points that attackers can exploit. Once access is gained, an attacker may be able to steal credentials, read messages, or use your personal data to attempt identity theft.
Hackers Gain Access to Phones
The methods attackers use evolve constantly. Here are the most common ways phones are compromised.
SMS Phishing (Smishing)
Fake text messages designed to look like they come from banks, delivery services, or government agencies. Clicking a link may take you to a page that asks for your credentials or downloads a file. The risk increases if you enter information, install something, or grant permissions. Learn more about mobile malware and how it reaches devices.
Malicious Apps
Apps downloaded from unofficial sources, or fake lookalike apps that make it into legitimate stores, may contain hidden threats. Review app permissions carefully before and after installation.
Dangerous Attachments
Malicious files can arrive through messaging apps, email, or file-sharing features. In most cases, opening and running a file, or granting it permissions, is what creates the risk. However, a category of more sophisticated attacks called zero-click exploits can compromise a device without any user action at all. In these cases, a vulnerability in the operating system or an app automatically processes a received file before you ever open it. Zero-click attacks are less common and typically require significant technical resources to deploy, but they have been documented in the real world and are worth knowing about.
Unsecured Wi-Fi Networks
Connecting to public or unsecured Wi-Fi can create interception risks in some scenarios. Modern HTTPS encryption significantly reduces what an attacker on the same network can read, but older or poorly configured networks carry higher risk. A VPN adds a layer of encryption regardless of the network you are on. A VPN does not remove malware or prevent every type of compromise.
Reused Passwords
One breached account can expose others if you reuse the same password. This is especially risky for email, cloud storage, and financial apps, since attackers who access email can often reset other account passwords.
Outdated Software
Operating system updates frequently contain security patches. Delaying them leaves known vulnerabilities open. Phone software updates are one of the most effective protections available.
SIM Swap
An attacker who convinces your carrier to transfer your phone number to a SIM they control can receive your calls and texts, including the one-time codes used for account verification. Learn how SIM swap scams work and how to help protect against them.
How to Check an iPhone
Follow these steps to review your iPhone for signs of compromise. If you suspect someone with physical access to your device may be monitoring it, see the stalkerware warning below before proceeding.
- Review Apple Account devices: Go to Settings, tap your name at the top, and scroll down to see all devices signed in to your Apple Account. Remove anything unfamiliar.
- Check recent security events: Visit account.apple.com on a trusted device and review recent sign-in activity.
- Use Safety Check: Go to Settings, Privacy and Security, Safety Check. This tool lets you review and revoke app permissions and account access.
- Review apps and configuration profiles: Go to Settings, General, VPN and Device Management. Remove any profile you do not recognize.
- Check app permissions: Go to Settings, Privacy and Security to review which apps have access to your camera, microphone, location, and contacts.
- Update iOS: Go to Settings, General, Software Update. Install any available updates.
- Review battery and data: Check Settings, Battery and Settings, Cellular to identify apps with unusual usage.
Note: Antivirus apps on iPhone are more limited than on Android due to iOS sandboxing. Follow Apple’s official guidance for security reviews rather than relying solely on third-party scanning apps.
How to Check an Android Phone
Follow these steps to review your Android device. Use a trusted device for account checks if you are concerned your phone may be actively compromised.
- Review Google Account security: Visit myaccount.google.com on a trusted device. Go to Security and review recent sign-in activity and devices with account access. Remove anything unfamiliar.
- Run Google Play Protect: Open the Play Store, tap your profile icon, and select Play Protect. Run a scan to check for harmful apps.
- Review apps and permissions: Go to Settings, Apps to see all installed apps. Remove any you do not recognize — unless you have a personal-safety concern, in which case see the stalkerware warning below first. Then go to Settings, Privacy, Permission Manager to review sensitive permissions.
- Check device administrator apps: Go to Settings, Security, Device Admin Apps. Revoke access for anything unfamiliar.
- Check accessibility permissions: Go to Settings, Accessibility and review which apps have accessibility access. This permission is sometimes abused by malicious apps.
- Update Android and Google Play: Go to Settings, System, System Update and check the Play Store for pending app updates.
- Review battery and data: Check Settings, Battery and Settings, Network to identify apps with unusual consumption.
Identify What Was Compromised
The right response depends on what type of compromise you are dealing with. Here are the four main scenarios.
Your Device Has Malware or a Malicious App
Signs: unfamiliar apps, unexplained data use, pop-ups, changed settings. Steps: remove the unknown app, revoke suspicious permissions, run a security scan, and update your software. Factory reset only if problems persist after these steps.
Your Apple Account or Google Account Was Accessed
Signs: unfamiliar sign-ins, security change notifications, password resets you did not request. Steps: sign in on a trusted device, review and remove unknown sessions, change your password, and enable stronger authentication. Secure your primary email account first since it can be used to reset other accounts.
Your Phone Number Was SIM Swapped
Signs: complete loss of cellular service, verification codes arriving on a different device, accounts locked. Steps: contact your carrier immediately to reverse the SIM swap, secure your accounts from a trusted device, and enable a carrier account PIN. Read more about SIM swap scams and recovery steps.
Someone with Physical Access May Be Monitoring Your Device
Stalkerware safety warning: If you suspect someone with physical access to your device, such as a partner or family member, has installed monitoring software, do not use this phone to search for help, remove apps, or reset the device. These actions can trigger alerts visible to the person monitoring you.
Use a trusted device, such as a friend’s phone or a library computer, to seek guidance. The National Domestic Violence Hotline at thehotline.org offers resources for people in potentially dangerous situations.
What to Do If Your Phone Has Been Hacked
Act quickly. The sooner you respond, the better you can limit the damage. Here is the full recovery sequence.
Step 1: Use a Trusted Device
If your phone may be actively compromised, perform account checks and password changes from another device. This prevents an attacker from seeing what you are doing in real time.
Step 2: Secure Your Primary Email and Apple Account or Google Account
Your email account is the master key to most of your other accounts. Secure it first. Change the password to something unique you have never used elsewhere, and enable stronger authentication.
Step 3: Remove Unknown Sessions and Devices
In your Apple Account, Google account, and email account, review all active sessions and connected devices. Sign out of everything unfamiliar.
Step 4: Change Passwords on Affected Accounts
Change passwords on your banking, social media, and any other account that may have been accessed. Use a unique password for each account. A password manager can help you create and store strong, unique passwords without having to remember them.
Step 5: Enable Stronger Authentication
Enable two factor authentication on all important accounts. Where possible, use an authenticator app or passkey rather than SMS codes, since SMS codes can be intercepted in a SIM swap. Two factor authentication significantly reduces the risk of unauthorized access even if a password is compromised.
Step 6: Contact Your Carrier or Bank If Needed
If a SIM swap is suspected, contact your carrier immediately. If financial accounts show unauthorized transactions, contact your bank or card issuer to report fraud and request a new account number.
Step 7: Update Software and Run a Security Scan
Install all pending software updates on your phone. Run a security scan using trusted device protection software. On Android, run Google Play Protect. On iPhone, follow Apple’s official guidance for reviewing apps and profiles.
Step 8: Remove Suspicious Apps and Profiles
Delete any apps or configuration profiles you do not recognize, and revoke any permissions that should not have been granted. If you have a personal-safety concern and suspect stalkerware, do not remove apps or reset the device from this phone. Use a trusted device to seek guidance instead.
Step 9: Factory Reset as a Last Resort
A factory reset should only be done after you have backed up essential files, documented what you found, and exhausted other recovery steps. A reset removes all data from the device and can help eliminate persistent malware in most cases.
Before resetting, back up only the essential files you need — not a full system backup. Restoring a full backup can reintroduce the same threats, including in stalkerware scenarios where the FTC notes that restoring apps from a backup can reinstall monitoring software.
Protect Your Identity After a Phone Compromise
If sensitive information may have been exposed, take these additional steps to help protect your identity.
- Review your financial accounts for unauthorized transactions and contact your bank immediately if anything looks wrong.
- Check your credit reports for new accounts, hard inquiries, or address changes you do not recognize.
- Place a fraud alert at one of the three major credit bureaus to make it harder for someone to open new accounts in your name.
- Consider a credit freeze at all three bureaus if you believe your personal information was stolen.
- Use IdentityTheft.gov to get a personalized recovery plan if your identity has been misused.
- Monitor for ongoing misuse: Dark web monitoring can alert you if your information appears on criminal forums.
Help Protect Your Identity with IdentityIQ®
When a phone is compromised, it can expose information that criminals use for identity theft long after the initial incident. IdentityIQ® offers tools to help you detect possible threats and respond quickly. IdentityIQ identity theft protection plans include:
- Device protection tools including antivirus scanning and a secure VPN
- Credit monitoring with alerts when we detect significant changes
- Identity theft insurance underwritten by AIG¹
- Identity restoration support from U.S.-based fraud specialists
- Dark web monitoring for your personal information
Place IdentityIQ protection after completing immediate security steps, not instead of them. A monitoring service supports your recovery but does not replace changing compromised passwords or securing your accounts.
Frequently Asked Questions: Is My Phone Hacked?
Here are answers to common questions about phone hacking, how to check your device, and what steps to take.
Can one sign prove my phone is hacked?
No. One symptom alone, including battery drain, overheating, or slow performance, does not prove your phone is hacked. These have many common non-malicious causes.
Stronger evidence includes unfamiliar devices in your accounts, apps you did not install, or messages sent without your knowledge. Multiple related signals together are more meaningful than any single issue.
Can an iPhone be hacked?
Yes, though iPhones have strong built-in security controls. The most common iPhone compromises involve Apple Account takeover rather than device malware.
Phishing, password reuse, and weak account security are the typical entry points. Review your Apple Account devices and recent security activity if you are concerned.
How do I check an Android phone for malware?
Open the Google Play Store, tap your profile icon, and select Play Protect. Run a scan to check for harmful apps. Also review your installed apps for anything unfamiliar, check device administrator and accessibility permissions, and make sure your Android version and Google Play system are up to date.
What code tells me if my phone is hacked?
There is no single code that reliably detects whether a phone has been hacked. Codes like *#21# show call forwarding status for your carrier line but do not reveal malware, account compromise, or most other attack types. Focus on the account and device checks in this guide rather than relying on dialing codes.
Does *#21# detect hackers?
No. The *#21# code displays call forwarding settings on your carrier line. It does not detect malware, account compromise, or unauthorized access. It can be useful to confirm whether call forwarding was enabled without your knowledge, but a blank result does not mean your phone is secure.
Will airplane mode stop a hacker?
Airplane mode cuts off your phone’s network connections, which can interrupt active data transmission. However, it does not remove malware already on the device or protect accounts that have already been accessed. It may be a useful short-term step to stop further data transmission while you investigate, but it is not a solution on its own.
Can a factory reset remove malware?
In most cases, yes. A factory reset wipes the device and removes most malware. Before resetting, back up only the essential files you need — documents, photos, and contacts — rather than a full system restore. Restoring a complete backup can reintroduce threats.
The FTC specifically warns that in stalkerware scenarios, restoring apps from a backup can reinstall monitoring software. If stalkerware is a concern, seek guidance from a trusted source using a different device before proceeding.
What should I do after a SIM swap?
Contact your carrier immediately to reverse the SIM swap and add a carrier account PIN to prevent future unauthorized changes. From a trusted device, secure your primary email and any accounts that may have received verification codes.
Change passwords on affected accounts and enable an authenticator app for two factor authentication instead of SMS. Read the full SIM swap scam guide for complete recovery steps.
¹ Identity theft insurance underwritten by AIG. Coverage terms, conditions, and exclusions apply. For full details, visit identityiq.com.
