Disclosure: This post contains affiliate links. If you make a purchase through these links, this blog may earn a small commission — at no extra cost to you. This helps keep the content free. All recommendations are based on independent research.
Something feels off. The battery is draining faster than usual. Apps are crashing that never crashed before. The phone is warm even when it's just sitting there. Maybe it's nothing — or maybe something is actually running in the background that shouldn't be. Here's how to actually tell if a phone has been hacked, what to look for on iPhone and Android, and what to do if the answer is yes. Last updated: June 2026.
10 Signs Your Phone Might Be Hacked
Most hacking doesn't announce itself. There's no alert, no flashing warning, no obvious sign — which is exactly what makes it hard to catch. But compromised phones do leave clues. Here are the ten most common signs, in order of how significant they actually are.
1. Battery Draining Much Faster Than Usual
Malware and spyware run in the background constantly — sending data, recording activity, maintaining connections — all of which chews through battery. If the phone suddenly loses charge two or three times faster than it used to, and a software update or new app didn't just install, it's worth investigating. This is the single most reported early sign of a compromised phone.
2. Phone Gets Hot When Not in Use
A phone that's warm while streaming video or gaming is normal. A phone that's noticeably warm while sitting idle on a table is not. Background processes running without permission — whether malware, stalkerware, or a rogue app — generate heat. If the phone is regularly warm for no obvious reason, something is running that shouldn't be.
3. Unfamiliar Apps Appearing
Scroll through the app list. Any apps that weren't deliberately installed — especially ones with generic names like "System Service," "Phone Manager," or strings of random letters — are a red flag. Some spyware disguises itself as system utilities to avoid detection. If it wasn't installed on purpose, it shouldn't be there.
4. Data Usage Spiking for No Reason
Spyware and malware communicate with external servers — uploading location data, recording audio, sending screenshots. All of that uses mobile data. Check data usage by app: on iPhone go to Settings → Cellular, on Android go to Settings → Network → Data Usage. If an app is consuming large amounts of data in the background and there's no explanation for why, that's a serious warning sign.
5. Texts or Calls Appearing That Were Never Made
Outgoing texts or calls in the logs that weren't made by the phone's owner is one of the clearest signs of compromise. Some malware uses the phone to send spam or participate in fraud networks without the user's knowledge. Check call logs and SMS history for anything unfamiliar.
6. Phone Is Slow or Laggy All of a Sudden
Unexplained slowdowns — especially on a phone that was running fine — can indicate background processes consuming CPU and memory. This is less specific than some other signs (updates and aging hardware cause this too), but combined with other items on this list it carries more weight.
7. Screen Lights Up or Activates on Its Own
A phone screen that turns on randomly when untouched — not from notifications, not from charging — may be responding to remote commands. This is rarer but highly indicative when it happens.
8. Weird Behavior During Calls
Clicking sounds, echoes, or static on calls that the other person isn't experiencing can occasionally indicate call interception. This is much less common than it used to be on modern encrypted networks — but it's worth noting if it's happening consistently.
9. Accounts Getting Locked Out or Showing Strange Activity
If email, social media, or bank accounts are showing logins from unfamiliar locations, or if password reset emails are arriving that weren't requested, the phone may have been used to access those accounts — or credentials were stolen from it.
10. Security or Antivirus App Was Disabled
Some sophisticated malware actively disables security software to avoid detection. If a security app that was enabled is suddenly turned off, or if it can no longer be opened, that's a significant red flag.
What to Dial to See If Your Phone Is Hacked
There are a few diagnostic codes that work on both iPhone and Android that reveal information about call forwarding and network settings — two things that get manipulated in certain types of phone compromise.
Check for Call Forwarding
One of the most common phone "tapping" methods involves setting up call forwarding so that calls are silently redirected to a third-party number. To check if this is active:
- Dial
*#21#and press Call — shows whether call forwarding is enabled and where calls are being sent - Dial
*#62#and press Call — shows forwarding settings for when the phone is off or out of coverage - To disable all call forwarding immediately: dial
##002#and press Call
Check Phone and Network Diagnostics
On Android (and some Samsung models specifically), dialing *#*#4636#*#* opens a hidden diagnostic menu that shows battery stats, usage history, and network information. This can help identify unusual network activity or battery drain patterns that don't match normal usage.
Samsung-Specific Check
On Samsung devices, dialing *#12580*369# shows software and hardware version information that can help identify whether the device has been modified or rooted without the owner's knowledge.
📋 Tap and hold any code above to copy it — then paste directly into the phone dialer.
How to Check If Your iPhone Is Hacked in Settings
iPhones are significantly harder to hack than Android phones in most scenarios — Apple's closed ecosystem, app review process, and sandboxing make it genuinely difficult for malicious software to install without the user's knowledge. That said, it's not impossible, especially through phishing, malicious profiles, or on a jailbroken device.
Check for Unrecognized Device Profiles
Configuration profiles — usually installed by employers or schools for device management — can also be installed by malicious actors to monitor activity. Go to Settings → General → VPN & Device Management. Any profile listed that wasn't deliberately installed (and isn't from a known employer or school) should be removed immediately.
Review App Permissions
Go to Settings → Privacy & Security and review which apps have access to the microphone, camera, and location. Any app with access that doesn't obviously need it — a flashlight app with microphone access, a recipe app with location "Always On" — is suspicious and the permission should be revoked.
Check iCloud Account for Unknown Devices
Go to Settings → [Your Name] and scroll down to see all devices signed into the iCloud account. Any device that isn't recognized should be removed from the account immediately, and the Apple ID password should be changed.
Check if the iPhone Is Jailbroken
A jailbroken iPhone bypasses Apple's security restrictions and is significantly more vulnerable. Look for apps called "Cydia," "Sileo," or "Zebra" — these are jailbreak app stores that wouldn't exist on a standard iPhone. If any are present on a phone that wasn't deliberately jailbroken, someone else modified the device.
How to Check If Your Android or Samsung Phone Is Hacked
Android phones are more open than iPhones by design, which makes them both more flexible and more vulnerable to compromise. The most common attack vectors are sideloaded apps (installed outside the Play Store), malicious links, and phishing.
Check for Apps Installed from Unknown Sources
Go to Settings → Apps and look for anything unfamiliar, especially apps with no icon, generic names, or that were installed around the time problems started. On Samsung specifically, Settings → Battery and Device Care → Device Protection runs a scan for known malicious software.
Check Device Admin Access
Some malware grants itself device administrator privileges to make it harder to uninstall. Go to Settings → Security → Device Admin Apps (path varies slightly by manufacturer). Any app listed here that wasn't deliberately granted admin access should be deactivated immediately and then uninstalled.
Check for Unknown Google Account Access
Go to myaccount.google.com → Security → Your devices. Any device listed that isn't recognized should be removed, and the Google account password should be changed with two-factor authentication enabled.
What to Do If the Phone Has Been Hacked
If the investigation above turns up genuine red flags — unknown profiles, call forwarding that wasn't set up, unfamiliar apps with admin access — here's what to actually do, in order.
1. Change passwords immediately — from a different device. If the phone is compromised, anything typed on it may be visible to whoever has access. Change email, banking, and social media passwords from a laptop or tablet, not the compromised phone.
2. Enable two-factor authentication on all important accounts. Even if a password was stolen, 2FA prevents it from being used without also having access to a secondary verification method. Authenticator apps are good — but for the highest level of protection on Google, Apple, and Microsoft accounts, a physical hardware security key is the most secure option available. A hardware key cannot be phished, cannot be intercepted, and works even if the phone itself is compromised. (Affiliate link — this blog earns a small commission at no cost to you.)
→ YubiKey 5 NFC Hardware Security Key on Amazon
3. Remove suspicious apps and profiles. On iPhone, remove any unrecognized configuration profiles via Settings → General → VPN & Device Management. On Android, revoke device admin access from suspicious apps, then uninstall them.
4. Update the operating system. Many exploits target known vulnerabilities that have already been patched in newer OS versions. Installing the latest iOS or Android update closes those doors.
5. Factory reset as a last resort. If the above steps don't resolve the issue — or if there's high confidence the phone is seriously compromised — a factory reset wipes everything and returns the phone to a clean state. Before resetting, back up contacts, photos, and important documents to a physical external drive rather than relying solely on a cloud backup from a potentially compromised account. A portable SSD is the safest way to store a clean backup that stays completely offline. (Affiliate link.)
→ Samsung T9 Portable SSD 1TB on Amazon
Once the factory reset is complete, restore only what's necessary — contacts, photos, and essential documents — rather than doing a full system restore. A full restore from a compromised backup can re-introduce the exact problem being fixed.
The Honest Take: Most Phones Aren't Actually Hacked
After years working in network and device infrastructure, the honest reality is that the vast majority of people who suspect their phone is hacked are dealing with something more mundane — a misbehaving app, a battery that's reached the end of its useful life, a software update that changed background behavior, or an account breach that happened through phishing rather than device compromise.
True phone hacking — in the sense of malicious software being installed without the user's knowledge — is genuinely less common than the anxiety around it suggests, especially on unmodified iPhones. Android is more exposed, but even there, the most common attack vectors are social engineering (clicking malicious links) rather than sophisticated remote exploits.
That said, the signs above are real, the diagnostic steps work, and it costs nothing to check. If something feels wrong, it's always worth looking — and if the investigation turns up nothing unusual, that's genuinely reassuring information.
For anyone whose battery drain or phone slowness seems like the main symptom — and it turns out the phone isn't hacked — these two breakdowns might be more relevant: Why Is My Phone Battery Draining So Fast? and Is Your Phone Slowing Down? Here's What's Actually Going On
Post a Comment