How to Know if Your Phone Is Hacked: 10 Warning Signs

Your smartphone holds your emails, banking apps, photos, passwords, and location history. If an attacker compromises it, the damage can be far worse than a stolen laptop. The problem is that modern mobile malware is designed to stay hidden, so most victims only notice something is wrong after the attacker has already caused harm.

This guide walks you through the 10 clearest warning signs that your phone has been hacked, explains what each symptom usually means, and shows you exactly what to do next. Whether you use an iPhone or an Android device, the signs below apply to both platforms.

What Does It Mean When a Phone Is "Hacked"?

A hacked phone is a device that has been accessed, controlled, or monitored by someone other than its owner without permission. This can happen through malicious apps, phishing links, stalkerware, SIM swap attacks, exploited operating system vulnerabilities, or physical access to the device.

Unlike dramatic Hollywood portrayals, real phone hacks are usually quiet. Attackers want persistent access, so they try to avoid draining your battery or crashing your apps. Still, almost every compromise leaves fingerprints. If you spot several of the signs below at the same time, you should treat your device as compromised until proven otherwise.

10 Warning Signs Your Phone Has Been Hacked

1. Your Battery Drains Much Faster Than Usual

Spyware and remote-access tools run constantly in the background, uploading data, listening to the microphone, or tracking your GPS. All of this activity consumes power. If your battery life suddenly drops by 30 percent or more without a software update, new app, or aging battery to explain it, treat it as a red flag.

Check your battery usage screen (Settings > Battery on both iOS and Android). Look for unfamiliar apps or system processes that account for a large share of consumption.

2. The Phone Runs Hot Even When Idle

A device that feels warm while sitting on your desk doing nothing is almost always running hidden processes. Cryptomining malware, surveillance tools, and bot software all generate heat. Occasional warmth during gaming or video calls is normal; constant heat while locked and unused is not.

3. Mobile Data Usage Spikes Unexpectedly

Malware needs to send data home. That could be your contacts, your keystrokes, screenshots, or audio recordings. All of it travels over your mobile data or Wi-Fi connection.

Open Settings > Mobile Data (iOS) or Settings > Network & Internet > Data usage (Android) and sort apps by consumption. If an obscure app or a system service is using gigabytes you cannot account for, investigate it.

4. Unknown Apps Appear on Your Home Screen

If you find apps you never installed, especially ones with generic names like "System Service," "Device Health," or blank icons, you may be looking at stalkerware or a dropper. On Android, check Settings > Apps and sort by install date. On iPhone, swipe through your App Library and look for anything unfamiliar.

Also check for configuration profiles on iPhone (Settings > General > VPN & Device Management). Legitimate users rarely have profiles installed outside of work-issued devices.

5. Pop-Ups, Redirects, and Strange Browser Behavior

Aggressive pop-ups appearing on your home screen, your browser redirecting to sites you did not type, or a new default search engine you did not choose are classic signs of adware or a browser hijacker. Legitimate iOS and Android systems do not show full-screen ads when you unlock your phone.

6. Friends Receive Messages You Did Not Send

If contacts tell you they got weird texts, DMs, or emails from you, especially ones containing links, your accounts or your device may be compromised. Attackers often use hijacked phones to spread malware to the victim's social circle because recipients are more likely to click a link from someone they know.

When you share links yourself, use a reputable shortener with click analytics so you can spot abnormal traffic patterns. Tools like Lunyb let you track whether a link is being shared or clicked in ways you did not intend. For a wider comparison, see our 2026 buyer's guide to URL shorteners.

7. Calls and Texts You Did Not Make Appear on Your Bill

Check your carrier bill or online account for calls to premium-rate numbers, international numbers you do not recognize, or SMS messages to short codes. Premium SMS fraud is a long-running mobile malware category because it generates direct revenue for attackers.

8. Your Phone Reboots, Freezes, or Lights Up on Its Own

A compromised device may restart to apply malicious updates, wake up to transmit data, or freeze when malware conflicts with legitimate processes. If your screen lights up at night without notifications, or if the camera indicator (the green or orange dot on iOS, the top-corner indicator on Android 12+) activates when no app should be using it, take it seriously.

9. You Cannot Log Into Your Accounts

If you suddenly cannot log into your email, cloud storage, or banking app, and password resets are being requested that you did not initiate, an attacker may have taken over. Combined with a SIM swap, this allows them to intercept two-factor authentication codes sent by SMS.

Warning signs of a SIM swap include losing cellular signal for an extended period for no reason, or your carrier sending you a message confirming a SIM change you did not request.

10. Security Settings Have Changed on Their Own

Check whether features like biometric unlock, screen lock, Find My Device, or app permissions have been altered. Malware often disables security tools, grants itself accessibility permissions, or adds itself as a device administrator. On Android, review Settings > Security > Device admin apps. On iOS, review Face ID & Passcode and Screen Time restrictions.

How Phones Get Hacked in the First Place

Understanding attack vectors helps you avoid them. Most mobile compromises fall into one of these categories:

1. Malicious apps downloaded from unofficial stores or sideloaded APKs that request excessive permissions.
2. Phishing links delivered through SMS (smishing), email, WhatsApp, or social media that lead to fake login pages or drive-by downloads.
3. Public Wi-Fi attacks where an attacker on the same network intercepts unencrypted traffic or serves fake captive portals.
4. Stalkerware installed by someone with physical access, often a partner, family member, or employer.
5. SIM swap fraud where attackers convince your carrier to transfer your number to their SIM card.
6. Outdated operating systems that still contain known, patched vulnerabilities.

What to Do If You Think Your Phone Is Hacked

If you spot two or more warning signs above, act quickly. Follow this process in order:

1. Disconnect from the internet. Enable airplane mode to stop active data exfiltration.
2. Review installed apps. Uninstall anything you do not recognize or did not install yourself.
3. Check device administrators and configuration profiles. Remove any you did not add intentionally.
4. Update your operating system and all apps. Patches often close the vulnerabilities attackers used to get in.
5. Change passwords from a different, trusted device. Start with email, banking, and your Apple ID or Google account. Never do this from the suspected device.
6. Enable app-based two-factor authentication. Use an authenticator app or hardware key instead of SMS where possible.
7. Contact your mobile carrier. Add a port-out PIN or account passcode to prevent SIM swap attacks.
8. Run a reputable mobile security scanner. On Android, tools from established security vendors can detect most known malware. iOS has fewer options but Lockdown Mode (iOS 16+) significantly reduces attack surface.
9. Perform a factory reset if symptoms persist. Back up photos and contacts, then wipe the device and restore only essentials. Do not restore a full backup if you suspect the backup itself is tainted.
10. Monitor your accounts for 30 to 90 days. Attackers often lie low after being discovered, waiting for you to let your guard down.

iPhone vs Android: Which Signs Matter Most?

Both platforms can be compromised, but the warning signs differ slightly because of how each operating system is built.

Warning Sign	iPhone	Android
Unknown apps appearing	Rare unless jailbroken or via configuration profile	Common with sideloaded APKs
Pop-up ads on home screen	Very unusual, strong red flag	Often from adware disguised as utilities
Battery drain from spyware	Possible with Pegasus-class attacks	More common due to broader malware ecosystem
Camera/mic indicator activating	Orange (mic) or green (camera) dot in status bar	Top-right indicator on Android 12 and newer
Device admin abuse	Managed via configuration profiles	Via Device Admin apps or Accessibility services
Jailbreak/root signs	Cydia, Sileo, or unexpected system changes	Magisk, SuperSU, or unlocked bootloader warnings

How to Prevent Your Phone From Being Hacked

Prevention is far cheaper than cleanup. These habits dramatically reduce your risk:

• Only install apps from official stores (App Store, Google Play) and read permissions carefully before accepting.
• Keep your operating system updated. Install security patches within a few days of release.
• Use a strong screen lock with a six-digit or alphanumeric passcode, plus biometrics.
• Enable automatic locking after 30 seconds or one minute.
• Turn off Bluetooth and Wi-Fi when you are not using them, especially in crowded public places.
• Use encrypted DNS such as DNS over HTTPS or DNS over TLS to prevent network-level snooping and malicious redirects.
• Verify links before tapping. Hover previews, link scanners, and trusted shortener services help. Suspicious shorteners can mask phishing destinations, so stick with providers that publish destination previews and abuse policies.
• Add a carrier account PIN to block unauthorized SIM swaps.
• Use a password manager and unique passwords for every account.
• Enable Lockdown Mode on iPhone if you are a journalist, activist, or executive who might be a targeted-attack victim.

Frequently Asked Questions

Can someone hack my phone just by knowing my number?

Knowing your number alone is not enough to install malware. However, it is enough to launch phishing attacks via SMS, attempt SIM swap fraud with your carrier, or add you to spam call lists. Treat your phone number as semi-sensitive information and never share it on public websites.

Will a factory reset remove hackers from my phone?

A factory reset removes almost all forms of malware, including stalkerware and spyware installed as apps. It does not remove firmware-level or bootloader-level compromises, which are rare and usually associated with nation-state attacks. For 99 percent of users, a reset followed by restoring only essential data from a clean backup is sufficient.

Can iPhones get hacked, or is it only Android?

iPhones can be hacked. They are harder to compromise at scale because of Apple's walled-garden app review and sandboxing, but targeted attacks like Pegasus have successfully breached fully updated iPhones. No device is immune. Lockdown Mode and timely updates are your best defense.

How can I tell if someone installed stalkerware on my phone?

Look for apps with generic names, apps with excessive permissions (accessibility, device admin, location, microphone), high background data usage, and faster battery drain. On Android, check Settings > Apps > Special app access. On iPhone, check for unknown configuration profiles. If someone had physical access to your unlocked phone and you suspect abuse, contact a domestic violence support organization before taking action; sudden removal can escalate situations.

Do I need to worry about public Wi-Fi hacking my phone?

Public Wi-Fi is lower risk than it used to be because most apps and websites now use HTTPS encryption by default. The main remaining risks are fake captive portals, malicious DNS responses, and unencrypted app traffic. Using encrypted DNS, keeping your OS updated, and avoiding sensitive transactions on untrusted networks mitigates most of the danger.

Final Thoughts

Mobile hacks rarely announce themselves. By the time you notice obvious damage, attackers may have already drained accounts, scraped contacts, or installed persistent surveillance. The 10 warning signs in this guide are early-warning indicators that let you act before serious harm occurs.

Make a habit of reviewing your battery usage, data consumption, installed apps, and account activity once a month. Combined with timely updates, strong authentication, and skepticism toward unexpected links, these simple checks will keep your phone and the sensitive data it holds safely under your control.