How to Check If Your Phone Is Hacked: Free Checks That Work (2026)

Suspecting your phone is hacked is unsettling — but you can check it yourself in under an hour, for free, using tools already built into Android and iPhone. This guide walks you through a 60-second quick check, the 12 warning signs that actually matter, device-by-device settings walkthroughs, what dial codes can (and cannot) tell you, and exactly what to do if a check comes back bad.

The 60-second check

Before anything else, run this five-point sweep. It uses only built-in tools, takes about a minute, and catches the most common compromise signals. You don't need to install anything.

1. Battery drain check. Open Settings → Battery (Android) or Settings → Battery (iPhone). Look for an app you barely use sitting near the top of background usage.
2. Data usage check. Open Settings → Network & internet → Data usage on Android, or Settings → Cellular on iPhone. A spike with no change in your habits is a classic spyware signal.
3. App inventory. Scroll your full app list. Anything you don't recognize — especially generic names — gets investigated before it gets trusted.
4. Permissions audit. Check which apps hold camera, microphone, accessibility, and device-admin permissions. These are the four powers real spyware needs.
5. Forwarding status. Dial *#21#. If call forwarding is active and you didn't set it, that's a serious signal — though it can also mean a carrier feature or an accident. Details in the dial-code section below.

One red flag is a reason to dig deeper; two or more are a reason to act today. The sections below turn each quick check into a proper investigation.

12 signs your phone is hacked (ranked by severity)

Not every glitch means a hacker. These are ordered roughly from most alarming to most ambiguous — the higher on the list, the less innocent the explanation tends to be.

1. Contacts receive messages you never sent. This is on Google's own shortlist of malware symptoms: your friends report odd texts, DMs, or emails "from you." If it's happening, treat compromise as likely and move straight to the fix steps.
2. Apps you didn't install appear — or apps vanish. Remote-access and spyware tools often arrive disguised as system utilities, "cleanup" tools, or update helpers. A generic-named app with no publisher trail is a red flag.
3. Settings change on their own. Call forwarding enabled without you, security settings toggled off, your passcode suddenly different — configuration drift you didn't cause is exactly what remote control looks like.
4. Camera or microphone indicators light up when idle. On iPhone (iOS 14 or later) a green dot means the camera is in use and an orange dot means the microphone is. On Android 12 and later, a similar indicator appears in the status bar. If they flick on with no app running, find out which app is responsible.
5. You're locked out of accounts, or get password-reset emails you didn't request. Sometimes the phone is just the first domino — the attacker may be working your accounts. Handle this as both a phone problem and an account problem.
6. Data usage spikes. Spyware silently uploads recordings, photos, and logs. Check monthly and per-app data figures; a malicious app often shows up near the top of mobile-data use.
7. Battery drains fast and the phone runs hot at idle. Recording mic audio, capturing screen, and uploading it all burns power. Heat while the phone is untouched in your pocket is more suspicious than heat during gaming.
8. Pop-ups appear outside any app, or a browser you didn't install shows up. Adware and affiliate-fraud payloads push full-screen ads and odd browser shortcuts.
9. Strange charges on your phone bill. Premium SMS subscriptions, mystery app charges, or international calls you never made can mean monetization malware — or a SIM-related problem. Call your carrier about anything you don't recognize.
10. Calls sound off, or replies don't match what people claim you sent. Static, echoes, or odd delays aren't proof by themselves, but combined with other signs they fit the picture of interception or a forwarded number.
11. The phone is suddenly sluggish. Random restarts, apps crashing, storage filling up "by itself." Low-severity on its own — software rot causes this too — but worth checking in combination.
12. Your phone knows things it shouldn't. Ads eerily specific to conversations, calendar invites you never made, or recovery emails for accounts you don't own. Creepy and imprecise — but consistent with mic capture or a leaked account.

First, rule out the innocent explanations

Good diagnosis means eliminating the boring causes first. Here are the usual suspects behind "hacked phone" panic that turn out to be harmless:

• An aging battery. Batteries degrade fast after a few hundred charge cycles. If your phone heats up and drains even in airplane mode with fresh software, an old battery is more likely than spyware. iPhones show the real number under Settings → Battery → Battery Health & Charging.
• Heavy apps and hot weather. Gaming, navigation, and video calls generate real heat, as does charging under a pillow or in direct sun. Context matters: heat during load is normal; heat at idle is the suspicious kind.
• New subscriptions or cloud backups. A data-usage spike may be a new streaming habit, a cloud photo upload, or a system update download. Per-app breakdowns will show the honest culprit.
• Carrier features. Visual voicemail, Wi-Fi calling setup, and spam-filter services sometimes enable forwarding-like behavior with a notification buried in your messages. Your carrier can confirm in one call.
• Work profiles and device-management apps. If your employer manages the phone, an admin app legitimately holds deep permissions and can change settings. Check whether a work profile exists before assuming the worst.

If the innocent explanations don't fit the pattern, the built-in checks below will give you a much clearer answer.

Free built-in checks anyone can run

Every check in this section uses tools Google or Apple already ship with your phone. Together they cover what most dedicated "scanner" apps actually look at — without the ads.

Battery and device health

On Android, open Settings → Battery and review per-app usage since last full charge. On iPhone, Settings → Battery shows a 24-hour and 10-day graph plus Battery Health. You're looking for an app with background activity wildly out of proportion to how much you use it. Tap the app to restrict background activity while you investigate.

Data usage audit

Android: Settings → Network & internet → Data usage, then App data usage. iPhone: Settings → Cellular, scroll to the per-app list. Spyware that streams mic or camera data must send it over the network — look for an unfamiliar app, or a familiar one using far more than it should. Compare against last month's numbers if your carrier app shows history.

App inventory and the four critical permissions

Walk your whole app list and uninstall anything you don't recognize. Then check permissions, focusing on the four that matter most:

• Accessibility — the single most abused permission on Android; it can read screens and inject taps.
• Device admin — apps with this can block uninstallation.
• Camera and microphone — anything holding these that isn't a camera, call, or recording app deserves scrutiny.
• Notifications & SMS (Android) — needed by banking-trojan malware to read one-time passcodes.

Android: Settings → Apps → [app] → Permissions. iPhone: Settings → Privacy & Security gives per-permission lists — much faster for this audit.

Google Play Protect scan (Android)

Play Protect is Android's built-in malware scanner. Google describes it as checking apps when you install them and periodically scanning your device, warning you about potentially harmful apps. To force a scan: open the Play Store → profile icon → Play Protect → Scan. If it flags an app, follow its uninstall prompt — don't dismiss it. Also verify Play Protect hasn't been switched off, which is something malware sometimes tries to do.

App Privacy Report (iPhone)

Turn it on via Settings → Privacy & Security → App Privacy Report. Apple's dashboard then shows which apps accessed the camera, microphone, and your network in the last seven days. An app that touched your microphone at 3 a.m. has some explaining to do. Sensor access without an obvious reason is exactly what you're hunting for.

Dial codes: what they can and can't tell you

Social media is full of "secret codes that detect hackers." The truth is narrower and more useful: these are standard GSM utility codes that show call-forwarding and device status — nothing more. Used correctly they catch one specific compromise (silent forwarding). Used as magic hack-detectors they spread false security.

What codes can't do: they cannot detect spyware, keyloggers, stalkerware, or account takeover. An attacker with software on your phone doesn't need forwarding at all. That's why the Settings-based checks above matter more — and why a "clear" code result proves nothing by itself.

Android walkthrough: check your phone in Settings

Google's own malware-removal guide boils down to four steps, and they double as an inspection routine. Follow them in order:

1. Turn on (and read) Google Play Protect. Play Store → profile icon → Play Protect. Run a full scan. While you're there, confirm "Improve harmful app detection" is on if offered. A clean scan doesn't clear everything — Play Protect misses stalkerware that arrives via sideloading — but any flag here is actionable.
2. Check for Android device and security updates. Settings → System → System update (varies by brand). Missing security patches are the number-one enabler of remote exploits. If an update is pending, install it before concluding anything — some "hauntings" end here.
3. Remove apps you don't trust. Settings → Apps. Sort or review recent installs first. Uninstall anything unrecognized, any app with generic names ("System Update", "Device Service" outside system lists), and any app whose permissions scare you. If an app refuses to uninstall, check Device admin apps under Settings → Security (or Biometrics and security) and revoke it first.
4. Run Google's Security Checkup. In a browser, visit myaccount.google.com/security-checkup. It reviews signed-in devices, third-party access, and saved passwords on your Google account — the attacker's usual second home. Remove any device or grant you don't recognize.

Extra Android checks: Settings → Security & privacy → Privacy dashboard (on Android 12+) shows microphone/camera/permission access with timestamps — the Android cousin of Apple's report. And on Samsung Galaxy phones, Settings → Battery and device care → Device protection runs Samsung's built-in scanner — run it once as a second opinion alongside Play Protect.

iPhone walkthrough: Safety Check & privacy audit

iPhone malware is rarer because apps can't be sideloaded the Android way — but account takeover, spyware from enterprise or shared devices, and stalkerware via iCloud all exist. Apple ships two purpose-built tools:

Run Safety Check (iOS 16 or later)

Go to Settings → Privacy & Security → Safety Check. Apple built this for people who fear someone has access to their device or accounts, and it's exactly the right tool here. You get two modes:

• Emergency Reset — immediately strips sharing and access for all people and apps. Use it if you believe someone has live access and you want it gone now.
• Manage Sharing & Access — a calmer review of who can see your location, what devices are signed into your Apple Account, which apps hold permissions, and your passwords/passcodes. Work through it screen by screen; remove anything unfamiliar.

Review the App Privacy Report and idle indicators

Turn on Settings → Privacy & Security → App Privacy Report and give it a day or two of data. Then check for camera or microphone use you can't explain. Meanwhile, watch the status-bar dots: green = camera in use, orange = microphone in use (iOS 14 and later). Tap Control Center right after a dot appears — the active app shows at the top.

Check who's inside your Apple Account

Settings → [your name] shows every device signed into your Apple ID. An unfamiliar device here beats any app-level suspicion — that's someone reading your iMessages. Remove it, then change your Apple Account password and enable two-factor authentication if it isn't on.

The WhatsApp and camera checks most people miss

Two checks rarely appear in mainstream guides, yet they cover the two questions everyone actually has: "is someone reading my chats?" and "is my camera watching me?"

WhatsApp linked devices

WhatsApp can be used from another computer or browser without touching your phone — through Linked devices. Open WhatsApp → More options (three dots) → Linked devices (iPhone: Settings → Linked Devices). Every active session is listed with its last-seen time. See a device you don't own? Tap it and Log out. Then set a Screen Lock for WhatsApp itself, and consider enabling two-step verification in WhatsApp settings so a stolen SIM can't re-register your number.

Camera and microphone indicators

Modern phones rat out silent listeners — if you know where to look:

• iPhone: green dot = camera in use, orange dot = microphone in use. When a dot appears, open Control Center — the responsible app is shown at the top.
• Android 12+: a green camera or microphone icon appears in the status bar while in use; pull it down to see which app. You can also toggle camera/mic access globally in Quick Settings when you want silence.

If an indicator lights with no app open, don't panic — check the App Privacy Report (iPhone) or Privacy Dashboard (Android) for the named app, then revoke its permission. Physical camera covers are still the only absolute guarantee against lens-level snooping, but permission hygiene handles the software route.

Your phone is hacked — now what? 8 steps in order

Checks came back bad, or the signs are unmistakable. Work top to bottom — order matters because each step protects the next:

1. Go offline first. Toggle airplane mode or disconnect Wi-Fi/mobile data. This stops active exfiltration without tipping off a stalker app through a visibly powered-down phone.
2. Change critical passwords from a different, trusted device. Email first — it's the master key to everything else — then banking, Apple/Google accounts, and social. Never change passwords from the suspect phone.
3. Revoke forwarding and SIM tricks. Dial ##002#, then call your carrier (from another phone) to confirm no forwarding, port-out freeze, or SIM changes exist. Ask about a carrier account PIN while you're at it.
4. Uninstall suspicious apps and revoke device-admin. Settings → Apps on Android; on iPhone, delete any profile you don't recognize under Settings → General → VPN & Device Management.
5. Run the platform scans. Play Protect full scan (Android) or a reputable mobile security app if you want a second opinion; on iPhone, Safety Check's Emergency Reset if someone may hold live access.
6. Sign out everywhere and audit devices. Google Security Checkup and Apple's device list both show every signed-in device. Kill unknown sessions, then re-secure with fresh 2FA.
7. Update everything, then monitor. Install pending OS updates, update remaining apps, and watch battery/data graphs for a few days. Quiet graphs with normal battery drain are your all-clear signal.
8. Factory reset — only after backup. The nuclear option that removes any software payload. Back up first (photos, contacts, authenticator seeds), then reset, then restore selectively — do not blanket-restore every app; reinstall what you actually use. If a hack preceded a bank loss or identity theft, also file a report with your local cybercrime unit or the FTC at reportfraud.ftc.gov.

How to prevent phone hacking

The FTC's prevention list is short for a reason — these five cover the realistic attack surface:

• Lock your phone. A 6-digit PIN or longer passcode, plus biometrics. This defeats the most common hack of all: someone with two minutes of physical access.
• Update your software promptly. OS updates carry the security patches exploits depend on bypassing. Both Google and Apple ship them monthly; install within days, not months.
• Back up your data. With cloud or local backups, the factory-reset option stays cheap — and ransom-y extortion loses its leverage.
• Turn on two-factor authentication everywhere that matters. Prefer authenticator apps or passkeys over SMS when possible, and add a carrier account PIN so your number can't be ported by a phone call.
• Never sideload "helpful" apps, and never dial codes on a stranger's instruction. Sideloading is how Android spyware gets in; the *21-style social trick is how calls get forwarded without any malware at all. Both are preventable with one rule: the phone's security is only as good as the person holding it.

Frequently asked questions

Read next

Email Security

PayPal Scam Email

Crypto Scams

Coinbase Scam Text

AI Security

AI Voice Cloning Scams