How to check if your phone is hacked

Secure the accounts behind your phone from a device you trust before you clean the phone itself.

Close-up of a smartphone wrapped in a chain with a padlock. — Photo: Towfiqu barbhuiya / Pexels

Area: InformationFrom age 13Time to learn: 30 minutes

A hacked phone usually gives itself away through account alerts you did not cause, apps you did not install, sudden battery drain or data use, or a sudden loss of service. You lock it down by updating it, removing unknown apps, changing passwords from a trusted device and, if the signs continue, resetting it.

SafetyIf you believe a partner or family member is monitoring your phone, plan with an advocate before you change anything, and contact them from a different device. In the US, call the National Domestic Violence Hotline at 1-800-799-7233 or text START to 88788. In Canada, find a local shelter or crisis line at sheltersafe.ca.

Why it matters

A phone can be compromised in three main ways: a malicious app, a taken-over account, or someone who had the phone in their hands. Each one leaves clues you can check. In a SIM swap, a criminal talks your carrier into moving your number to their phone so that your login codes go to them. The FBI received 971 SIM swap complaints in 2025, with reported losses of $17.4 million. Securing the accounts first and then the device stops an attacker from simply logging back in.

How to do it

Look for the signs: the battery draining faster than usual, unexpected data use, overheating, the phone turning off and on, pop-ups, apps you did not install, or messages and posts you did not send.
Check your accounts for warnings: sign-ins you do not recognize, login codes you did not request, or a password that no longer works. On iPhone, check your Apple Account. On Android, open your Google Account and review its recent security events.
If your phone suddenly shows no service where it normally works, call your carrier from another phone right away and ask whether your number has been moved to a new SIM. Ask them to add a PIN or password to your account, and a number lock if they offer one.
If you think someone close to you installed tracking software, stop here and contact a domestic violence advocate before you remove anything, because removing it can alert that person. Use a different device to make contact. In the US, call 1-800-799-7233. In Canada, find a local shelter or crisis line at sheltersafe.ca.
Update the phone's operating system and every app.
Delete any apps you do not recognize or no longer use. On Android, keep Google Play Protect turned on: open the Play Store, tap your profile icon, then Play Protect > Settings > Scan apps with Play Protect.
From a computer or phone you trust, change your passwords, starting with your email and then your Apple or Google account, your bank and your social media. Turn on two-factor authentication for each.
Remove any devices you do not recognize from your Apple or Google account, and confirm that the recovery phone number and email are yours. On iPhone, run Safety Check (Settings > Privacy & Security > Safety Check) to review who and what can access your information.
If the signs continue, back up your photos and contacts, factory-reset the phone, and reinstall apps from the app store rather than from a backup, since a backup can bring the problem back.
Report it. In the US, use ReportFraud.ftc.gov, or ic3.gov if you lost money. In Canada, report to the Canadian Anti-Fraud Centre at 1-888-495-8501 or reportcyberandfraud.canada.ca, and contact your local police if you lost money.

Common mistakes

Changing passwords on the phone you think is compromised, where an attacker may be able to see them.
Ignoring a sudden loss of service. A SIM swap gives the attacker your text-message login codes.
Restoring everything from a backup after a factory reset, which can reinstall the app that caused the problem.
Deciding the phone is hacked just because it is slow or warm. An old battery or a heavy app can cause the same signs, so check your accounts for warnings as well.

You can do this when …your phone is fully updated, you recognize every app on it, your main accounts have new passwords and two-factor authentication, and the only devices signed in to them are yours.