Is my phone hacked? How to tell — and what to do on iPhone and Android

Most phones that "act weird" aren't hacked: Google notes that an app you downloaded can make a phone restart, freeze, crash or run slow. The useful question is narrower: did something change that you didn't change yourself — a new app, a message sent in your name, a login you didn't make?

Signs your phone may be hacked

• Apps you don't remember installing, or ones you can't account for.
• Pop-ups and ads appearing outside the apps you're using.
• Emails, texts or social posts sent from your accounts that you didn't write — the FTC lists this among the signs of malware.
• A two-factor sign-in code you didn't request, or a password that suddenly stops working. Apple lists both as signs that someone else may be using your Apple Account.
• A battery that drains faster or data use that climbs for no clear reason. The FTC suggests asking these questions if you suspect monitoring software — not treating them as proof. To see which app is responsible on an iPhone, check Settings > Battery > View All Battery Usage and the app list under Settings > Cellular.
• The camera or microphone indicator comes on when you aren't using either: on an iPhone, a green dot means the camera (or camera and microphone) and an orange dot the microphone; Android 12 and later show a green indicator at the top right of the screen.
• Charges you don't recognize on your phone bill. The FCC says unauthorized "cramming" charges often go unnoticed as small mystery fees — sometimes only $1, $2 or $3 — and suggests reviewing the bill every month.
• No service out of nowhere, or a phone that only allows emergency calls. The FCC says that is usually the first sign of port-out fraud.

Any one of these can have an innocent cause. Look for patterns, and for changes you didn't make. A phone that feels warm isn't a sign by itself: Apple says warmth is normal while you charge wirelessly, play games or use graphics-heavy apps, stream high-quality video, set up the phone, restore it from a backup or install a software update.

Do codes like *#21# or *#62# show whether you're hacked?

No. They are standard GSM codes (3GPP TS 22.030) that query your carrier: *#21# shows whether all your calls are being forwarded, *#62# whether calls are forwarded when the phone is off or out of range, and ##002# cancels all forwarding. *#06#, by contrast, is answered by the phone itself and only shows its IMEI. None of them detects malware or stalkerware. On an iPhone you can also check Settings > Apps > Phone > Call Forwarding (GSM networks only); if you see forwarding you didn't set up, ask your carrier.

How phones usually get compromised

• A link in a text, email or chat that leads to a fake sign-in page or a download.
• An app installed from outside the App Store or Google Play. Google Play Protect also checks apps that come from other sources, and Google recommends always keeping it on.
• A jailbroken iPhone. Apple warns that unauthorized modifications to iOS can let hackers steal personal information or install malware, spyware or viruses, and can stop future updates from installing.
• Someone who knows your passcode and has had the phone in hand — the case covered in the next section.
• A SIM swap or port-out: your number moved to a phone someone else controls (see "If your phone suddenly has no service" below).

If someone close to you may be monitoring you

If you think a partner or someone you know installed monitoring software (stalkerware), think about safety before deleting anything. The FTC warns that removing it may alert the person who installed it, and suggests reaching out for help from a device they can't access. On iPhone, Apple's Safety Check — Settings > Privacy & Security > Safety Check, on iOS 16 or later — lets you review and stop sharing with people and apps, and has a Quick Exit button if you need to hide the screen fast.

What to do on an iPhone

1. Update iOS: Settings > General > Software Update, and turn on Automatic Updates. Updates often include critical security fixes, the FTC notes.
2. Check your Apple Account's devices: in Settings, tap your name and scroll to the device list. If you don't recognize a device, tap it and choose Remove from Account.
3. If you got sign-in codes you didn't request or your password stopped working, change your Apple Account password and confirm that the email address and phone number on the account are still yours.
4. Delete apps you don't recognize, and don't install apps or configuration profiles from links in messages.
5. Review what apps can reach: Settings > Privacy & Security, then a category such as Camera, Microphone or Photos, lists the apps that asked for access; App Privacy Report on the same screen shows how they use it. Control Center also tells you when an app used the camera or microphone recently.
6. Lockdown Mode (Settings > Privacy & Security > Lockdown Mode) is an optional, extreme protection for the very few people who may be personally targeted by sophisticated attacks. Apple notes that most people never are. If Apple believes you were individually targeted by mercenary spyware, it sends a threat notification; these never ask you to click links, install apps or profiles, or give your password or a verification code — check for one by signing in at account.apple.com.
7. As a last resort, back up and erase the phone: Settings > General > Transfer or Reset iPhone > Erase All Content and Settings. If you suspect stalkerware, the FTC advises against restoring apps from a backup afterwards.

What to do on an Android phone

1. Make sure Google Play Protect is on: open the Play Store, tap your profile icon, then Play Protect > Settings, and turn on Scan apps with Play Protect. Google recommends always keeping it on.
2. Install updates: Settings > System > Software updates (menu names vary by manufacturer).
3. Uninstall apps you don't trust or don't remember installing. If the phone misbehaves, Google suggests restarting in safe mode — how you get there depends on the phone maker — and removing recently downloaded apps one at a time.
4. Review permissions: Settings > Apps > [app] > Permissions, or the Permission manager under Security & Privacy > Privacy to see which apps can use your location, camera or microphone. The Privacy dashboard (Settings > Security and Privacy > Privacy dashboard) shows which apps used them, and when.
5. If pop-ups or redirects come from websites, turn off that site's notifications in Chrome: open the site, open Page info, then Permissions > Notifications.
6. Check which apps can administer the phone and remove any you don't recognize — on Pixel phones under Settings > Security > Advanced security settings > Device admin apps.
7. Run Google's Security Checkup at myaccount.google.com/security-checkup to review your Google Account.
8. If you still see signs of malware, Google says you may need to reset the phone or ask its manufacturer for help. A factory reset erases everything: back up first and make sure you know your Google Account password.

If your phone suddenly has no service

Losing service out of nowhere — the phone going dark or allowing only 911 calls — is usually the first sign of port-out fraud, according to the FCC: someone has moved your number to a phone they control and can receive your text-message codes. Call your phone company right away (from another phone, since yours has no service), then contact your bank. The FCC also suggests filing a police report and placing a fraud alert with the credit bureaus. To make it harder next time, ask your carrier about adding a PIN or password to your account.

Once the phone is clean

• Change the passwords for your email, bank and other important accounts, and turn on two-factor authentication. The FCC warns that someone who takes over your number can receive codes sent by text, and Apple offers security keys for extra protection against targeted phishing.
• Check your bank and card statements — and your phone bill, which the FCC suggests reviewing just as closely — for charges you don't recognize.
• Leave automatic updates on for the system and your apps, and install apps only from the App Store or Google Play.
• Cover the FTC's other basics: lock the phone with a passcode of at least 6 digits, back up your data, and turn on the feature that helps you find a lost phone.
• Check your passwords: Google's Password Checkup flags exposed, weak and reused passwords, and on an iPhone the Passwords app flags weak, reused and leaked ones so you can change them.
• If an account was hacked, tell your friends and contacts. The FTC suggests asking them not to click links in messages from you and to ignore requests for help or money.

Does a phone need antivirus?

Apple says every third-party app on an iPhone is sandboxed, so an iPhone security app can't scan other apps the way desktop antivirus does; the suites we cover offer things like scam and phishing protection, a VPN and breach alerts there instead. Android phones already have Play Protect; a security app adds the most when someone at home installs apps from outside Google Play, or when you want warnings about scam texts and links on every device in the house.

A hacked phone usually shows itself through your accounts, not your battery. Start with updates, your account's device list and your passwords.