Two or more of these signs together usually mean trouble
A hacked phone usually shows several signs at once: it runs hot and the battery drains while idle, data use jumps, apps you never installed appear, and friends get texts or calls you did not send.
One sign alone is normally a bad update, a bloated app or an old battery. The signs that matter most are the ones that cost money or involve other people: a phone bill with numbers you never called, a bank alert for a login you did not make, or a password-reset email you did not ask for.
Pop-ups outside the browser and a phone that lights up or restarts on its own are also worth a look. In our experience they are far more common on Android phones with apps installed from outside the Play Store than on any iPhone.
- Battery drains while the phone sits idle, and the back feels warm
- Mobile data use jumps with no new app to explain it
- An app you did not install, or a settings screen you did not change
- Texts, calls or social posts sent in your name
- Bank, email or Apple ID alerts about a sign-in you did not make
- Two-factor codes arriving that you did not request
- Phone bill shows premium numbers or a new line
How to check an Android phone in ten minutes
On Android, the useful checks live in Settings under Battery, Apps, Security and Accessibility, plus a Play Protect scan from the Play Store; a Samsung phone has the same screens under slightly different names, with an extra scan under Device care.
Stalkerware installed by someone with the phone in hand is the most common real-world Android hack we hear about. It needs Accessibility or Device admin rights to read the screen, so those two lists are the ones to read carefully.
Read battery and data use by app
Open Settings, then Battery, then the per-app list. Do the same under Network and Data usage. An app near the top that you do not recognise, or a system-looking name with a typo, is the first thing to look at.
List every installed app
Settings, Apps, See all apps. Look for anything you did not install, especially apps with generic names like System Service or Sync. Tap it and check the install date against when the signs began.
Check Device admin and Accessibility
Settings, Security, then Device admin apps; and Settings, Accessibility. Only screen readers and apps you chose should have these rights. Remove rights from anything unfamiliar before you uninstall it, or the uninstall button stays grey.
Run a Play Protect scan
Open the Play Store, tap your profile picture, then Play Protect, then Scan. It catches known malware and flags apps installed from outside the store.
Check the Google account from another device
Open the Google account security page on a laptop. Review signed-in devices, recent security activity, and Gmail forwarding rules. Sign out of any device you do not own.
How to check an iPhone
On an iPhone, true malware is rare; the realistic risks are a shared Apple ID, a configuration profile you did not install, a passcode someone learned, and tracking or family features switched on by a person who handled the phone.
If you worry about Pegasus-class spyware because of your job, that is a different problem: it leaves almost no signs on screen, and none of the checks below will find it. Apple's Lockdown Mode cuts the ways in, and a specialist forensic check is the only real answer. We have not run those tools ourselves.
Look at the Apple ID device list
Settings, tap your name, scroll to the bottom. Every phone, iPad, Mac and watch signed in with your Apple ID is listed. Remove any you do not recognise, then change the Apple ID password from a different device.
Look for profiles you did not add
Settings, General, VPN and Device Management. A company or school profile you agreed to is fine. A profile you cannot explain can route your traffic or install certificates; remove it.
Run Safety Check
Settings, Privacy and Security, Safety Check. It lists every person and app with access to your location, photos and shared data, and lets you cut them off in one pass.
Read battery by app
Settings, Battery, then the last ten days. An app you rarely open sitting near the top is worth uninstalling.
Most phones are hacked by a tap, not by a genius
Nearly every hacked phone got that way through a phishing link, an app from outside the official store, a SIM swap at the carrier, or a fake public Wi-Fi hotspot, not through a flaw in the phone itself.
Scam texts and emails are now written with AI tools, so the old spelling-mistake test no longer works. Judge the request, not the grammar: a real bank, carrier or delivery firm never asks for a password or a one-time code.
SIM swapping deserves its own line. The attacker talks your carrier into moving your number to their SIM, and from then on your calls and two-factor codes go to them. Dashlane notes that even Twitter's then-CEO lost his number this way in 2019.
Phone hacking typically happens when someone falls into a trap set by a hacker, such as clicking a phishing link or downloading apps from unauthorized sources.
Dashlane, How to Know If Your Phone Is Hacked, updated August 2026
| How it happens | What it looks like on the phone | What stops it |
|---|---|---|
| Phishing link in a text or email | A login page that looks right, then password-reset emails you did not ask for | Two-factor codes from an app, not SMS; typing the site address yourself |
| App from outside the official store | Battery drain, data spikes, ads outside the browser | Official store only; Play Protect on; no sideloading |
| SIM swap at the carrier | Phone drops to no service, then codes and calls stop arriving | A port-out PIN or account PIN set with the carrier |
| Fake public Wi-Fi hotspot | A login page on a network that looks like the cafe or hotel | A VPN on before you connect; see the public Wi-Fi guide |
| Stalkerware installed by hand | Accessibility or Device admin rights granted to an app you do not know | A passcode nobody else knows; checking those two lists |
What to do in the first hour
If the signs add up, do four things in order: cut the phone off the internet, remove the app you do not recognise, change passwords from another device, and warn your carrier, your bank and your contacts.
The order matters. Changing a password on the phone before you remove a keylogger hands the attacker the new password too.
Switch on airplane mode
This stops the phone sending anything while you work. On Android, restart into safe mode as well so third-party apps cannot run.
Remove the app or profile
Android: revoke its Device admin and Accessibility rights, then uninstall. iPhone: delete the profile under VPN and Device Management, then the app.
Change passwords from a laptop or a second phone
Email first, because every other reset flows through it. Then banking, Apple ID or Google, and social accounts. Sign out of all other sessions where the account offers it.
Call your carrier
Ask whether your number was moved or forwarded recently, and set a port-out PIN. If calls and texts stopped arriving, treat it as a SIM swap and say so.
Tell the bank and your contacts
Ask the bank to watch the account or freeze the card. Send a short message to family and friends that any odd text from your number is not you.
A factory reset removes almost all phone malware
A factory reset wipes every app and setting, which removes nearly all Android malware and any iPhone profile; back up photos and messages first, then restore files rather than apps afterwards.
Security.org makes the same call: antivirus is good at prevention, but there is no guarantee it removes an attacker who is already in, and a reset is the more reliable fix.
The reset does not fix a SIM swap or a stolen account password, because those live with the carrier and the account, not on the phone. Do the carrier call and the password changes regardless.
Restore this
- Photos and videos
- Contacts
- Text messages
- Notes and documents
Do not restore this
- The full app list
- Device admin settings
- Old configuration profiles
- Saved Wi-Fi networks you cannot name
Back up what you need
iPhone: Settings, your name, iCloud, and choose what to back up. Android: Settings, Google, Backup. Photos and messages matter; apps do not, because a backed-up bad app comes straight back.
Reset an iPhone
Settings, General, Transfer or Reset iPhone, Erase All Content and Settings, then confirm with your Apple ID password.
Reset an Android phone
Settings, About phone or System, Reset options, Factory reset, Erase all data, then enter your PIN. Samsung phones list it under General management.
Set up as new, then restore selectively
During setup, sign in and restore photos, contacts and messages from the backup. Reinstall apps one by one from the official store instead of restoring the app list.
Camera, phone number, IP address and a phone that is off
Your camera can be used only by an app with camera permission, your number alone cannot install anything, your IP address is a public label that cannot be hacked, and a phone that is fully powered off cannot be reached.
Camera: both Android and iPhone show a green dot in the status bar when the camera is live. Check Settings, Privacy, Camera for the list of apps allowed to use it and remove any you cannot explain. Number: someone who knows it can send phishing texts, look you up, or attempt a SIM swap at the carrier, which is why the port-out PIN matters. A cloned SIM shows up as calls and texts that stop arriving, not as a change on the screen.
IP address: see yours at tealvpn.com/what-is-my-ip. It tells a stranger your rough city and your provider, nothing more, and it changes when you move between Wi-Fi and mobile data. Powered off means powered off; a phone that is merely locked or asleep is still online.
Prevention that works, and where a VPN honestly fits
The habits that prevent most phone hacks are updates installed the day they ship, apps only from the official store, a lock screen PIN nobody else knows, two-factor codes from an app rather than text, and a port-out PIN at the carrier.
Teal VPN, made by Fxolio LLC, has a Free plan (500 MB a day, 2 devices) and a Pro plan, with apps for Android, Android TV, Windows, Mac, Linux and Chromebook; as of November 2026 there is no iPhone app. It encrypts the path between the phone and the internet, which closes the fake-hotspot route, and Teal Secure keeps the connection working on networks that restrict VPNs.
A VPN does not detect or remove malware, and it does nothing about a phishing link you tap or a SIM swap at the carrier. We think most people over-rate the Wi-Fi risk and under-rate the SIM swap. If you already suspect a hack, clean the phone first; a VPN on an infected phone carries the attacker's traffic as well as yours.
- $7.99
- Teal Pro per monthas of 9 November 2026
- $36
- Teal Pro per year$3 a month; up to 10 devices
- 30 days
- money-backcard, Apple Pay, Google Pay, PayPal or crypto
- 500 MB a day
- Teal Free2 devices, email only
Keep reading
References
- Dashlane: How to Know If Your Phone Is Hacked
- Security.org: What To Do if Your Phone Has Been Hacked
- Proton: How to know if your phone is hacked and what to do next
Need help with Teal? Contact support.
Questions
How do I know if my iPhone is hacked?
Check the Apple ID device list under Settings and your name, look for profiles under General and VPN and Device Management, and run Safety Check. Malware on a current iPhone is rare; a shared Apple ID or a known passcode is the usual cause.
How do I know if my Android phone is hacked?
Read battery and data use by app, list every installed app, check Device admin and Accessibility for rights you did not grant, and run a Play Protect scan. An app you cannot explain with Accessibility rights is the clearest sign.
Is there a code to check if my phone is hacked?
No. The dialer codes shared online show call-forwarding status on some carriers; they do not detect malware. Forwarding you did not set up is worth clearing, but a clean result proves nothing.
Can someone hack my phone just by knowing my number?
Not directly. A number lets someone send phishing texts, look you up, or try a SIM swap at your carrier. Set a port-out PIN and treat unexpected one-time codes as a warning.
How do I know if my phone is tapped or monitored?
On a modern phone, monitoring means an app with Accessibility or Device admin rights, a shared Apple ID, or a family-tracking feature, not a wire. Our guide on whether your phone is being monitored walks through each one.
Will antivirus remove a hacker from my phone?
Antivirus prevents many infections but cannot guarantee removal once an attacker is in; a factory reset is the reliable fix. Change passwords and call the carrier either way.
What should an employer do if an employee's phone is hacked?
Revoke the device's sessions and tokens, rotate any credentials stored on it, wipe the work profile or the whole device, and check for forwarding rules in the work mailbox before letting the phone back on the network.