Is someone spying on your phone?

Rapid battery drain, lagging performance, unexplained mobile data usage – these could be signs of a silent intruder on your phone: spyware. This malicious software, installed without your knowledge, can lie hidden while stealing your passwords, tracking your location, and recording your calls. 

Fortunately, there are some simple ways to check if your paranoia is warranted or if there’s an innocent explanation for your worries. 

15 signs someone is spying on your phone

1. Unfamiliar applications

Spyware or monitoring software will often be disguised as innocent-looking apps to avoid detection, so keeping on top of what’s installed on your device is a simple way to weed out malicious software. 

Get ExpressVPN

If you spot something you didn’t install, try searching online for the app’s name along with your device’s operating system. This is especially important so you can tell the difference between pre-installed/system-essential apps versus apps that you can safely remove.

2. Anomalous data usage

An unexplained increase in data usage could be a sign of spyware. Since the malicious software has to send collected data back to an external server, this leads to an increase in data uploaded from your device. Both iOS and Android allow you to check both mobile and Wi-Fi data usage of each installed app. If you notice a sudden spike that you can’t account for by your own behavior, take a closer look at which app is responsible, and whether it’s legitimate.

3. Your device is “rooted” or “jailbroken”

Rooting (for Android) or jailbreaking (for iOS) removes restrictions put in place by the operating system, allowing for deeper customization, while also bypassing numerous security measures. This makes your phone more susceptible to spyware. 

If you didn’t root or jailbreak your device yourself, but discover that it’s rooted, it’s possible that someone else did so for malicious purposes. If this is the case, the most likely culprit is someone with physical access to the device, since rooting a device is almost impossible remotely.

4. Your phone battery is draining fast

Since spyware often runs constantly in the background, it can lead to your battery draining far faster than normal. If you suddenly notice this happening, check your phone’s battery information. It should show you a breakdown of how much battery each app is using, so you can quickly narrow down the potential culprits.

5. Your phone is getting too hot

Similar to the issue with battery drain, an app running in the background can also cause issues with overheating. Since constant use of your phone won’t give it a chance to cool down, temperatures can build up to the point where it’s noticeable to the touch. If this happens, check your battery breakdown for which app is consuming the most power, as well as mobile and Wi-Fi data usage.

6. Unusual activity on linked accounts

Our phones are connected to numerous accounts, including social media, email, cloud storage, and plenty more. If you notice activity on some of these accounts that you don’t recognize, it could be a red flag. This could involve messages you didn’t send, posts you didn’t make, password change alerts that you didn’t initiate, or files you didn’t upload/download. 

Most social media platforms provide a detailed breakdown of your activity, as well as which devices you’re logged in on (and where). If you spot anything that looks off, change your login details right away. You can also check Have I Been Pwned to see if your email has been found in any data breaches, which are usually responsible for this type of illicit account access.

7. Intrusive pop-ups

Pop-ups, whether they’re just notifications you don’t recognize or hijacking your entire screen, can be a symptom of malware infection. These pop-ups are likely an attempt to phish for personal information or to convince you to download other malicious software. Exercise caution and don’t click on any pop-ups.

Ironically, one of the most common types of pop-up scams is the technical help pop-up. It will warn you that there’s an issue on your device that needs professional help to fix, followed by someone you should contact or software you should download. Of course, doing either of the above will only worsen the problem.

8. Strange activity in standby mode

If your phone shows signs of activity, such as the screen lighting up, apps opening or closing, or the device making sounds while it’s supposed to be in standby mode, it may be under someone else’s control. 

Your camera being remotely tapped into is potentially an even worse privacy invasion. Many modern phones display a little light at the top of your screen when your camera or microphone is in use. If you see this happening while not using your camera, it’s worth looking into.

9. Issues shutting down the phone

Experiencing difficulties or delays while shutting down your phone can indicate that malware is preventing the process. Since spyware wants to remain active as long as possible, it’s in its interest to prevent the phone from shutting down. While phones may sometimes have unrelated shutdown/restart issues, experiencing consistently problematic shutdowns could be a sign of a more serious issue.

10. Random reboots

Frequent reboots by themselves aren’t necessarily a sign of malware. It could simply be a bug due to unstable apps you have installed, outdated system software, or an aging phone having battery issues or other hardware defects. 

However, if you can rule out all of the above (make sure your system software and all apps are fully updated, and that your phone’s hardware isn’t to blame), malware could be a cause. If you can’t figure out why this is happening, your best bet is to take the device to a professional.

11. Someone’s hacked your email

If it seems like someone has accessed your email, they could have done it through your phone, where many people stay logged in to their email accounts. Investigate how someone might have hacked into your email to rule out other possibilities. You can check where activity came from in Gmail via “last account activity”. Look out for activity that came via your phone that you don’t remember.

12. Weird noises during phone calls

Hearing unusual noises such as clicks or static during phone calls can be disconcerting. While network issues are normally to blame for these issues, consistent occurrences might indicate that there’s something more sinister happening. This kind of eavesdropping is a serious privacy invasion and often requires sophisticated spyware.

13. The phone wakes up randomly

If your phone is frequently waking up from being asleep without any notifications or interaction from you, there’s a chance it’s affected by malware. However, before you jump to this conclusion you should make sure there isn’t an innocent reason for it. Accidental touches, voice commands waking the device, or even simple bugs are likelier culprits ahead of malware.

14. Autocorrect is behaving strangely

Autocorrect could be infuriating at the best of times. But if it starts inserting stranger words than usual or not functioning as smoothly as it used to, it could be a sign of malware interference. Some spyware affects keyboard inputs to capture passwords and other sensitive information. However, it’s also possible that the keyboard you’re using is suffering from a bug, or that your phone’s screen is malfunctioning and recording incorrect button presses. Either way, it’s worth finding out the root cause.

15. Autonomous app storage permissions for Android phones

On Android devices, apps should only have the permissions that you explicitly grant. However, if you notice apps autonomously acquiring storage or other sensitive permissions without your approval, it could be a sign of malicious intent. This behavior suggests that an app may be trying to quietly access or export your data.

How to find spy software on your phone (Android and iOS)

Below are some general step-by-step instructions for both Android and iPhone users to help you detect and deal with potential spyware.

However, if you’re genuinely concerned that you’re a target of a spyware attack, your best bet is to seek out anti-malware specialists who focus on these issues to ensure that any threat is permanently removed.

Find spyware on Android

Note that, depending on your Android OS version and phone brand, some of the steps may vary slightly, but should generally be a good guideline.

1. Check installed applications
   Go to Settings > Apps > See all apps. Scroll through the list to find any applications that you don’t recognize. Spyware might disguise itself with a nondescript name or copy the names of more reputable apps to avoid detection.

2. Review app permissions
Within Settings, navigate to Privacy > Permission manager. This area allows you to see which apps have access to sensitive parts of your device like the camera, microphone, location, and more. Be wary of apps with permissions that don’t make sense for their function.

3. Detecting usage access
Spyware often requires access to usage data to monitor your activity. Check this by going to Settings > Security > Apps with usage access. A legitimate app will rarely need to access this data, so anything listed here that isn’t a system utility or something you explicitly use might be suspicious.

4. Running services
Under Settings > Developer options > Running services, you can see what services are currently running on your device. This might require enabling developer options by tapping the build number under “About phone” multiple times. Any unknown services running in the background could be malicious.

Find spyware on iPhone

1. Check for unknown apps
   Browse through your Home Screen and App Library for any apps you don’t remember installing. Spyware on iPhones can be more difficult to install without jailbreaking, so you should investigate any unfamiliar apps.
2. Review app permissions
   Go to Settings and scroll down to see all installed apps. Tap on each app to review its permissions, especially for critical features like microphone, camera, and location services. Unjustified permissions might indicate malicious intent.
3. Check battery usage
   Spyware can drain your battery more quickly. Check this by going to Settings > Battery. You can see a breakdown of which apps are consuming your battery. An app using a high percentage of your battery without active use is a red flag.
4. Look at Screen Time
   Settings > Screen Time provides insights into your phone usage. High activity on certain apps, especially ones you don’t use frequently, could indicate spyware activity.
5. Update and restrict background app refresh
   Go to Settings > General > Background App Refresh. This feature allows apps to update content in the background. Consider disabling it entirely or for specific apps that don’t need to be constantly updated, as spyware might abuse this feature to remain active.

How to remove spyware on your phone

How to remove spyware apps on Android

1. Use a spyware removal tool

Install a reputable anti-malware or security app from the Google Play Store. Look for apps with high ratings and positive reviews from trusted developers. Once installed, run a complete scan of your device to detect and remove any spyware or malicious software. These tools are designed to identify and eliminate threats with minimal input required. 

Additionally, ensure that Google Play Protect is enabled on your device. Without it, it’s far easier for malicious software to be installed. As such, you should also be wary of ever being asked to turn Play Protect off – if you are, it’s likely part of a scam to lower your device’s protection.

2. Remove the app manually

If you’ve discovered a suspicious app, you can remove it manually. Go to Settings > Apps & notifications > See all apps. Find the app, tap on it, and then select Uninstall. If the app doesn’t allow you to uninstall it, it may have administrator access. In that case, go to Settings > Security & location > Device admin apps (this path might vary slightly depending on your device), and deactivate the app before attempting to uninstall it again.

3. Updating the operating system

Keeping your operating system updated is crucial for security. Go to Settings > System > System update. If there’s an update available, download and install it. Updates often include patches for security vulnerabilities that malware might exploit.

4. Carry out a factory reset

If all else fails, you can perform a factory reset as a last resort to remove spyware. However, this will erase all data on your device, so ensure you back up important files first. To factory reset, go to Settings > System > Reset options > Erase all data (factory reset). Follow the prompts to complete the process.

How to remove spyware apps on iPhone

1. Remove the spyware manually

Similar to Android, begin by looking for and removing any unfamiliar apps. Tap and hold the app icon on your Home screen or App Library, then select Remove App > Delete App. If you suspect a specific app is spyware but it looks legitimate, research it first to confirm your suspicions before removal.

2. Update the operating system

Always ensure your iPhone is running the latest version of iOS, as updates often include important security enhancements. To update, go to Settings > General > Software Update. If an update is available, tap Download and Install.

3. Carry out a factory reset

If spyware remains or if you want to ensure all potential threats are removed, a factory reset is the most thorough option. Before proceeding, back up your iPhone using iCloud or your computer. To reset, go to Settings > General > Reset > Erase All Content and Settings. Enter your passcode or Apple ID password if prompted, then wait for the process to complete.

How to protect your phone against spying

Here are 10 simple ways to improve your phone’s security and avoid spyware:

1. Install updates promptly: Regularly update your device’s operating system to benefit from the latest security patches. 
2. Use official app stores: Only download apps from the Google Play Store for Android or the App Store for iPhone to avoid malicious software.
3. Think carefully before rooting or jailbreaking: Although doing so can offer more freedom with how you use your device, it also opens it up to more security vulnerabilities. This is especially true on iOS, which (at the time of writing) doesn’t allow the installation of apps from outside of the official App Store.
4. Change your account logins: One of the primary methods to spy on iOS devices doesn’t involve installing anything on the device; it simply requires the target’s iCloud/Apple login details to see all synced texts, photos, locations, and more. Ideally, you should regularly change your details to prevent this form of attack. Note that this also exists for Google users, although it’s less common.
5. Secure your lock screen: Always lock your device. Passwords and PINs are the main defense against intruders; avoid ones that have important birthdays or other personal information that a hacker might try first. Among biometric methods, iris scans are the strongest, if you have a choice. 
6. Stay alert to phishing scams: Exercise caution with emails, messages, and social media links, especially if they request personal information or require immediate action from you. Cybercriminals have developed extremely convincing scams to trick you into installing spyware.
7. Install security software: While Google’s Play Protect already does a good job of scanning apps, and iOS is a lot stricter with what you can install, there are some good third-party options available to scan your device for malware.
8. Be cautious with public Wi-Fi and use a VPN: Avoid using public Wi-Fi without protection. A VPN is essential for encrypting your data on both Android and iPhone, preventing man-in-the-middle attacks. ExpressVPN also comes with Threat Manager to help protect you against malicious sites.
9. Backup your data regularly: Ensure you have recent backups, so you don’t lose everything if you need to reset your device due to spyware.
10. Get the strongest native protection: Both Apple and Google offer advanced tools for people who believe they’re a legitimate potential target of advanced malware (think activists, journalists, whistleblowers, etc.). Apple’s is called Lockdown Mode and can be found in the iOS settings, while Google’s is known as the Advanced Protection Program and has to be separately enrolled in.

Can someone spy on my phone without touching it?

While far less likely than if an attacker has physical access, it’s still possible for spyware to be installed remotely. These are some of the ways in which this can happen:

• Phishing emails and messages: Cybercriminals use phishing tactics to trick you into downloading spyware. They send emails or messages that appear to be from a trusted source, enticing you to click on a link or download an attachment that secretly installs spyware on your phone.
• Exploiting software vulnerabilities: Cybercriminals can exploit unpatched vulnerabilities in the operating system or in apps to remotely install spyware on your phone.
• Abusing account insecurity: If an attacker gains access to your Apple or Google account they can potentially see your messages, photos, location, and contact info (if synced). Spyware can collect all of this info and display it for the attacker in a compact dashboard. As a result, using a strong password alongside 2FA is essential.
• Unsecured Wi-Fi networks: Public Wi-Fi networks that lack encryption can be a hotbed for malicious actors. Attackers can intercept the data transmitted over these networks, including sensitive information that could be used to gain unauthorized access to your device. 

Get ExpressVPN

Can someone spy on my phone through linked contacts?

No, someone cannot spy on your phone just by having your contact information linked. However, certain risks do exist if malicious apps or spyware gain access to your contacts or other personal data. If a third party has installed spyware or gained unauthorized access to your device, they could potentially use your contacts to gather more information about you. It’s crucial to be cautious about which apps you grant access to your contacts and ensure you only download apps from trusted sources.