Is my phone hacked? How to check an iPhone or Android
Most phones that feel hacked are just old, full or running one bad app. A few signs do mean trouble. Here is how to tell them apart, the checks that take five minutes, and what to do first if something is wrong.
The signs that matter are things you cannot explain: an app, profile or device admin permission you did not add, calls forwarded somewhere, login codes you never requested, or a sudden loss of service. A hot phone or a weak battery on its own almost never means a hack. On an iPhone, check VPN & Device Management, Safety Check and your Apple Account device list. On Android, run Play Protect and review device admin and accessibility apps. If something is wrong, change your email password from another device first, then update or reset the phone.
Signs of a hacked phone, and what they usually mean
Every sign on most “is my phone hacked” lists has an everyday explanation, and the everyday one is right most of the time. The right column is when to take it seriously.
| What you notice | Usually | Worth worrying when |
|---|---|---|
| Battery drains fast, phone runs warm | An update, an old battery, or one app stuck in a loop. Settings → Battery shows which app is using it. | An app you do not recognise sits near the top of the battery list, or the drain started right after you installed something. |
| Mobile data use jumps | Video, backups or app updates running on mobile data instead of Wi-Fi. | An unfamiliar app is sending a lot of data, especially in the background while you are not using the phone. |
| Pop-ups and strange ads | A browser site pushing notifications you once allowed by tapping “Allow”. | Ads appear on the home screen or inside unrelated apps. On Android that usually means an adware app. |
| Apps or profiles you did not install | A work or school device management profile you agreed to and forgot. | Any profile, device admin app or accessibility permission you cannot explain. This is how stalkerware gets control. |
| Calls not ringing, texts missing | Do Not Disturb, a Focus mode, or poor signal. | Calls are forwarded somewhere you did not set, or the phone suddenly shows “SOS only” or no service. That can be a SIM swap. |
| Login codes you did not request | Someone mistyped their own number or email. | Codes arrive for several accounts in a row, or a password reset email you did not ask for follows them. |
1. Check an iPhone in five minutes
Open Settings → General → VPN & Device Management. If you see a profile you did not install for work or school, tap it and remove it: profiles can route your traffic and install apps. Next, go to Settings → Privacy & Security → Safety Check, which shows who you share location and data with and which apps have access to the camera, microphone and location. Then tap your name at the top of Settings and scroll to the device list. Any phone or computer you do not own should be removed, and you should change your Apple Account password. Finally, install any waiting iOS update.
2. Check an Android phone
Open the Play Store, tap your profile picture, then Play Protect, and run a scan. Then look at two permission lists that stalkerware needs. Device admin apps usually sit under Settings → Security (on Samsung, Security and privacy → Other security settings). Accessibility is under Settings → Accessibility → Installed apps. An app with either permission can read your screen or stop you from uninstalling it, so remove anything you do not recognise. Last, open your Google Account’s Security Checkup at myaccount.google.com and sign out devices you do not own.
3. Check your number, not just the phone
A lot of “my phone got hacked” cases are really about the phone number. In a SIM swap, a criminal convinces your carrier to move your number to their SIM. Your phone drops to no service or “SOS only”, and their phone starts receiving your login codes. If that happens, call your carrier from another phone straight away. Quieter variant: call forwarding switched on so that voice verification calls go to someone else. On AT&T and T-Mobile, *#21# shows forwarding status. To prevent both, turn on your carrier’s number lock and set an account PIN.
4. If you think it is hacked: the order matters
Start from a different device you trust. Change the password on your email first, because every other reset goes through it, then your Apple or Google account, your bank and your phone carrier account. Sign out all other sessions as you go. Only then deal with the phone: update it, remove the suspicious apps and profiles, and if anything still looks wrong, back up your photos and do a factory reset, setting it up as new. If you suspect a partner or family member installed stalkerware, think about your safety before removing it, because the person will notice. The National Domestic Violence Hotline (1-800-799-7233) can help plan that step.
5. Lockdown Mode is for a small group
iPhones have a Lockdown Mode (Settings → Privacy & Security → Lockdown Mode) that switches off many features spyware has used to get in, such as some message attachments and web technologies. It makes the phone less convenient, and Apple says it is meant for people who may be personally targeted by sophisticated attacks: journalists, activists, officials, lawyers in sensitive cases. Most people get more protection from automatic updates, a strong passcode and refusing to tap links in unexpected texts.
6. About the phone hacks in the news
Stories like the October 2026 claim that Russian intelligence got into Jared Kushner’s iPhone in 2017 describe state-level operations. Those claims come from a book excerpt published by Vanity Fair; Kushner denies them, and CBS News could not verify them. Attacks of that kind are built not to show the usual signs, so a hot battery tells you nothing about them. For everyone else, the real risks are dull ones: a reused password, a fake login page, a stolen number, or an app someone with access to your phone installed.
Most account takeovers start with leaked data, not a hacked phone
A password from an old breach, or a phone number listed on people-search sites, is usually how someone gets into an account or talks a carrier into a SIM swap. PersProtect checks your email against known breach databases, looks for your phone number and address on people-search sites, and files the removals.
Check my exposure — free →Hacked phones, answered
How can I tell if my phone is hacked?
Look for things you cannot explain rather than things that are merely annoying. An app you never installed, a configuration profile or device admin app you did not add, calls being forwarded, accounts sending login codes you did not ask for, or a sudden loss of service are real warning signs. Slow performance and a weak battery on their own are almost always age, updates or one misbehaving app.
Can an iPhone be hacked?
Yes, but ordinary iPhone users are far more likely to lose an account than to have the phone itself broken into. The common routes are a stolen Apple Account password, a phishing page that captures a login code, or someone who knows the passcode and had the phone in their hands. Spyware that breaks into an iPhone remotely exists, but it is expensive and used against a small number of targets such as journalists, activists and officials. Apple sends threat notifications to people it believes were targeted that way.
Can someone hack my phone just by calling or texting me?
Almost never on an updated phone. Attacks that need no tap at all have been found and patched several times, which is exactly why installing updates matters. The realistic danger in a text is the link: it leads to a page that asks for a password or code, or to an app download outside the official store. Do not tap links in unexpected texts, and you remove most of the risk.
Does a factory reset remove spyware?
A factory reset removes apps and profiles, which covers nearly all spyware and stalkerware ordinary people run into. Set the phone up as new or restore from a backup made before the problems started, otherwise you may restore the bad app too. Then change your passwords from a different device, because a reset does nothing about an account the attacker already has the password for.
What is *#21# and does it detect hacking?
On AT&T and T-Mobile, dialling *#21# shows whether your calls are being forwarded, and ##002# switches all forwarding off. It does not detect spyware. It catches one specific trick: forwarding your calls so that a bank or account’s voice verification call goes to the scammer. Verizon customers can turn forwarding off with *73.
How do I stop a SIM swap?
Ask your carrier to lock your number. T-Mobile calls it SIM Protection, Verizon has Number Lock and SIM Protection, and AT&T has Wireless Account Lock. Set a separate account PIN or passcode as well. Then move your important accounts away from text message codes to an authenticator app or passkey, so a stolen number is no longer enough to get in.
Is the Jared Kushner phone hack story true?
It has not been proven. In October 2026 Vanity Fair published an excerpt from a book by Matthew Cole claiming Russian military intelligence got into Kushner’s iPhone in 2017 and that Dutch intelligence later saw it. Kushner denies the account, and his lawyer said he does not know whether the phone was hacked. CBS News said it could not independently verify the claims. Either way, it is not a sign that ordinary iPhones are easy to hack.
Your phone is clean. Is your number?
See which breaches include your email and which sites publish your phone number and address. It is free and takes about a minute.
Run my free exposure scan →