A smartphone in hand. If several warning signs appear together, it is worth checking the phone for malware or a hacked account.
Your phone holds your messages, photos, banking apps, email accounts, and location history, which makes it one of the most valuable targets for criminals.
Most people only realise something is wrong when money goes missing or friends report strange messages, but hacked phones usually give off warning signs much earlier.
Learning to recognise those signs can help you act before a small problem turns into identity theft or financial loss.
The good news is that a hacked phone is rarely a mystery once you know what to look for, and most problems can be fixed with a few careful steps.
This guide explains the 10 warning signs that matter most, how to check an Android phone or an iPhone, and exactly what to do if you think your phone has been hacked.
It draws on guidance from consumer protection and cybersecurity authorities, including the United States Federal Trade Commission and the United Kingdom National Cyber Security Centre.
One Sign Alone Rarely Proves a Hack
Before running through the list, it is important to keep one thing in mind: a single symptom on its own rarely proves that a phone has been hacked.
Batteries age and drain faster over time, phones run hot during games or on weak mobile signals, and a busy app can slow everything down after a software update.
A phone that is nearly full of storage will also lag, freeze, and restart more often, which looks alarming but has nothing to do with malware.
What matters is a change from normal, especially when several signs appear together and cannot be explained by a new app, an update, or an ageing battery.
Two or three warning signs at the same time deserve a proper check, while a cluster of five or more should be treated as a genuine security problem.
It also helps to know what "hacked" usually means in practice, because the most common case is not a phone broken into remotely.
In most cases, what people call a hacked phone is actually a hacked account, meaning someone has obtained the password for a Google, Apple, email, or social media account.
The next most common cause is a malicious app, installed from outside the official app store or disguised as a legitimate tool, which shows ads or steals data.
Less common but more serious is stalkerware, a monitoring app installed by someone with physical access to the phone, while targeted spyware aimed at journalists and activists is rare for ordinary users.
10 Warning Signs Your Phone May Be Hacked
1. Your battery drains much faster than usual. Malicious software that tracks your location, records audio, or uploads your photos keeps working in the background, and that constant activity costs power around the clock.
If your battery life has suddenly fallen sharply with no change in how you use the phone and no recent software update, that is a genuine red flag worth investigating.
2. Your phone runs hot when you are not using it. A handset that feels warm in your pocket while idle is doing work you did not ask it to do, because a phone at rest should cool down quickly.
Occasional warmth during gaming, video calls, or charging is completely normal, but constant heat when the screen is off and no apps are running points to hidden background activity.
3. Your mobile data usage suddenly spikes. Spyware and adware need to send stolen messages, photos, and location data to a server somewhere, and that upload traffic shows up on your data bill.
Check data usage per app in your phone settings and compare it with a normal month, because an unfamiliar app or a familiar app using far more data than it should deserves a closer look.
4. Your phone slows down, freezes, or restarts by itself. The United States Federal Trade Commission lists unexpected restarts, slowdowns, freezes, and crashes among the signs of spyware, and the United Kingdom National Cyber Security Centre gives the same warning.
A faulty app can cause identical symptoms, so this sign matters most when it starts suddenly and continues after you have closed apps and restarted the phone.
5. You see pop-ups and ads outside the browser. Aggressive pop-ups on the home screen or over other apps are a classic sign of adware, especially when the ads are explicit, flashing, or completely unrelated to anything you have viewed.
Legitimate websites show ads inside the browser, but ads that appear when no browser is open usually come from a malicious app hiding on the phone.
6. Apps appear that you never installed. Finding an app you do not recognise on your home screen or in your app list is one of the clearest warning signs, because malware often installs itself under a generic name such as System Service or with a blank icon.
Check your full app list, not just the home screen, and treat any app you cannot explain as suspicious until you have identified what it is.
7. Friends receive messages you never sent. If contacts mention texts, emails, or social media posts from you that you did not write, malware or a compromised account may be using your identity to spread phishing links.
This is one of the strongest signals that something is genuinely wrong, because it shows an attacker is actively using your accounts rather than merely lurking on the device.
8. You cannot log in, or your settings changed by themselves. Passwords that suddenly stop working, password-reset emails you did not request, and security settings that switch themselves off all suggest someone else has access to your account.
On Android, watch for an unknown device administrator app or a VPN profile you did not add, and on any phone, check for unfamiliar devices signed in to your Google or Apple account.
9. You spot charges or purchases you did not make. Unknown charges on your phone bill, premium text subscriptions you never signed up for, or purchases in your app store history are serious warning signs of fraud.
Criminals often test a compromised phone or account with small charges first, so even a tiny unfamiliar transaction should be reported to your carrier or bank straight away.
10. Your camera, microphone, or phone behaves strangely on its own. Photos or videos in your gallery that you do not remember taking, a camera indicator light that switches on unexpectedly, or a phone that refuses to shut down completely can all indicate remote control by malware.
Modern phones show a green or orange dot when the camera or microphone is active, so an indicator that appears while no app should be recording deserves immediate attention.
How to Check Your Phone
On Android, start with Google Play Protect, which is switched on by default and scans installed apps for known malware, including apps installed from outside the Play Store.
Open the Play Store, tap your profile picture, choose Play Protect, and run a scan, then review the full app list in Settings for anything unfamiliar.
Also check Settings for device administrator apps and unknown VPN profiles, and look at battery and data usage per app to find anything consuming far more than it should.
On iPhone, open Settings and check the list of devices signed in to your Apple account, then run Safety Check, available in Settings under Privacy and Security on iOS 16 and later, to review who and what can access your data.
Look for unfamiliar configuration profiles in Settings under General, and check Screen Time or battery usage by app for anything unusual.
If you are at higher risk as a journalist, activist, or public figure, Apple Lockdown Mode adds extreme protection by blocking many common attack routes.
One useful test on either platform is safe mode, which on Android restarts the phone with only pre-installed apps running, so you can see whether the symptoms disappear.
If the phone behaves normally in safe mode, a third-party app is almost certainly the culprit, and you can remove recently installed apps one by one until the problem stops.
Keep a note of anything you delete, including the date and the app name, in case you need it for a report to your carrier or bank.
What to Do If You Think Your Phone Is Hacked
Disconnect from the internet first. Switch on aeroplane mode to cut the malware off from its server while you work, which stops further data theft and prevents the attacker from sending more messages from your accounts.
Do not turn on Wi-Fi or mobile data again until you have removed suspicious apps and changed your most important passwords.
Remove suspicious apps and profiles. Delete any app you do not recognise, starting with the most recently installed ones, and remove unknown configuration profiles or device administrator apps in Settings.
If an app refuses to uninstall, that itself is suspicious, and restarting in safe mode usually allows you to remove it cleanly.
Change your passwords from another trusted device. Start with your email account, because email is the key to resetting almost everything else, then move on to banking, social media, and shopping accounts.
Use a clean computer or a trusted friend's device for this step, since changing passwords on the compromised phone itself could expose the new passwords to the attacker.
Turn on two-factor authentication everywhere it is offered. Two-factor authentication means a stolen password alone is no longer enough to break into your account, because the attacker would also need a code from your phone or security key.
Prefer an authenticator app or a hardware security key over text-message codes where possible, since text messages can be intercepted through SIM swap fraud.
Update your phone and run a full security scan. Install the latest operating system update and the latest versions of your apps, because updates often close the exact security holes that malware exploits.
Run Play Protect on Android or review Safety Check on iPhone again after updating, and check that no unfamiliar devices remain signed in to your accounts.
Factory reset as a last resort. If problems continue after removing suspicious apps and changing passwords, the safest fix recommended by cybersecurity authorities is a factory reset in Settings, which wipes the phone completely.
Reinstall apps fresh from the official store afterwards rather than restoring a backup that might contain the malware, and only restore photos and files you trust.
How to Protect Your Phone in the Future
Prevention is far easier than cleanup, and a few habits block most phone attacks before they start.
Only install apps from the Google Play Store or the Apple App Store, check the developer name and reviews before downloading anything unfamiliar, and be suspicious of apps that ask for permissions they do not need, such as a torch app requesting access to your contacts.
Keep automatic updates switched on for the operating system and your apps, since most successful attacks exploit flaws that have already been patched.
Be equally careful with links and attachments, because phishing texts and emails remain the most common way malware reaches a phone.
Do not tap links in unexpected messages about parcels, bank accounts, or prizes, and never install an app from a link sent by a stranger, even if the message appears to come from a friend whose account may itself be compromised.
If someone calls claiming your phone is hacked and offering to fix it, hang up, because that call is itself a well-known tech support scam.
Finally, review your phone once a month in the same way you would check a bank statement, looking at installed apps, signed-in devices, and data usage per app.
Set a screen lock with a strong passcode or biometrics, avoid public Wi-Fi for banking unless you use a trusted VPN, and back up your photos and files so a factory reset never means losing anything precious.
These small routines take only a few minutes and make your phone a far harder target.
Frequently Asked Questions
Can an iPhone be hacked? Yes, although iPhones are harder to infect than Android phones because Apple restricts app installation to the App Store and reviews every app.
Most iPhone problems turn out to be hacked accounts, phishing, or a malicious configuration profile rather than true device malware, but targeted spyware does exist, which is why Safety Check and Lockdown Mode are worth knowing about.
Does a factory reset remove all malware? A factory reset removes almost all consumer malware and stalkerware, because it wipes every app and setting back to the factory state.
Extremely rare and sophisticated spyware can survive in device firmware, but for ordinary users a reset followed by fresh app installs is the most reliable cleanup available.
Should I install an antivirus app on my phone? On Android, Play Protect already provides built-in malware scanning, and a reputable security app can add phishing and Wi-Fi protection if you want it.
On iPhone, antivirus apps cannot scan the system in the same way, so your best protection is keeping iOS updated, avoiding suspicious profiles, and using strong account security.
What if someone I know installed spyware on my phone? Stalkerware is often installed by a partner or former partner with physical access to the phone, and it may hide under a fake system name in your app list.
If you suspect this, seek help from a trusted support organisation before confronting anyone, change your passwords from a safe device, and consider a factory reset with fresh app installs.
If several warning signs in this guide match your phone, do not panic and do not ignore them either, because early action limits the damage.
Work through the checks calmly, remove anything suspicious, secure your email and banking accounts from a trusted device, and reset the phone if problems persist.
A phone that is clean, updated, and protected with two-factor authentication is a difficult target, and the habits in this guide will keep it that way.