--- title: "How to Know If Your Phone Is Hacked (and What to Do)" url: https://playciso.com/blog/how-to-know-if-your-phone-is-hacked updated: 2026-11-07 section: Blog publisher: PlayCISO --- # How to Know If Your Phone Is Hacked (and What to Do) > Battery drain, pop-ups, odd texts: which signs of a hacked phone are real, which are normal, and what to do on iPhone and Android, step by step. Source: https://playciso.com/blog/how-to-know-if-your-phone-is-hacked · Published: 2026-11-07 · Publisher: PlayCISO (https://playciso.com) --- **Your phone is probably not hacked just because the battery drains fast or it feels warm, because those have many ordinary causes. The signs that deserve action are different: apps you did not install, login codes you did not ask for, settings or accounts changed without you, and messages you did not send.** If you see more than one of those, check your apps and accounts, use the built-in tools on iPhone or Android, and reset the phone if it stays unexplained. This guide separates the real signs from the normal ones and gives the order to act in. This is general advice for ordinary users. Phones differ, and menu names change between versions, so follow the official help pages in the sources below for your exact model. ## Do this now: a calm first-hour order - Do not panic and do not tap scare pop-ups. A web page cannot scan your phone for viruses. A pop-up that says it found some is a scare tactic, and the "clean now" button or phone number is the trap. Close the page or browser. - Look at your installed apps. Scroll through the app list in settings. Anything you cannot explain, from a developer you do not know, is worth removing. Check the permissions of apps that ask for a lot, such as access to messages, accessibility or device administration on Android. - Check which apps use the battery and data. The battery screen in settings lists usage by app. An unfamiliar app with heavy background use is a clue. Exact menu names vary by phone, so use the search box in settings. - Android: run Play Protect. Google says Play Protect checks apps before you download them and checks your device for harmful apps from other sources, and recommends keeping it on. Open the Play Store, tap your profile icon, tap Play Protect, then scan. If it flags an app, Google says you can tap the notification and choose Uninstall. - iPhone: review sharing with Safety Check. On iOS 16 or later, Apple says to go to Settings, Privacy & Security, Safety Check. It lets you review and stop sharing with people and apps, with an Emergency Reset option that stops sharing with everyone and everything at once. Apple notes it cannot review non-Apple accounts or passwords. - Secure your accounts from a different, trusted device. If your phone might be compromised, a new password typed on it could be seen. Change your email password first, because password resets usually go through email, then turn on two-step verification and sign out other sessions. Then do your bank, social media and shopping accounts, with a unique password for each. - If the phone is still odd, try safe mode on Android. Google says to use safe mode if the phone restarts itself, freezes, crashes or runs slowly, then remove recently installed apps one at a time and restart normally after each. If the problem remains, an app is probably not the cause. - If it is still unexplained, back up your own files and factory reset. Google says a reset removes all data from the phone. Apple's guide says erasing the iPhone removes all information and settings, including apps installed without your knowledge. Restore carefully: a full backup might bring back the problem, so consider setting up as new and adding photos and contacts in steps. Download apps only from the official store. - If money moved, tell the bank. Phone your bank using the number on your card or its official website, never a number from a message. Ask them to secure the account and replace cards. In the US, the FTC says to report fraud at ReportFraud.ftc.gov, and to use IdentityTheft.gov if personal details such as a card or bank number were shared. Rehearse these decisions in the [Phone Hacked Triage Lab](/tools/phone-hacked-triage-lab), a scenario with fictional people where nothing real is at stake. ## How to tell: real signs and normal causes No single symptom proves a phone is hacked. Weigh the signs together. Here is how to think about the common ones. ### Often ordinary - Fast battery drain. An ageing battery, a recent system update, a bright screen, weak signal and busy apps all drain power. Look at the battery usage list before suspecting an attacker. - A warm phone. Charging, gaming, video calls, direct sun and a thick case all warm a phone. - Slow performance or crashes. Full storage, a buggy app or an old model are likelier causes. Google's safe mode page is aimed at exactly these symptoms and treats them as a prompt to find a problem app, not proof of an attack. - Pop-ups and ads in a browser. Sites can ask permission to send notifications, and scam ads imitate virus alerts. Remove the site's notification permission and close the page. This is a nuisance, not a break-in. - High data use. Video, cloud backups and updates use a lot of data. Check which app is using it. ### Worth acting on - Apps you did not install, especially ones that ask for broad permissions or hide their icon. - Login or reset codes you did not request. Someone may know your username and be trying to get in. Never share the code. - Messages or posts you did not send, reported by friends. Messages can be faked without touching your phone, so this means check your accounts, not that the phone is certainly compromised. - Passwords, recovery emails or settings changed without you, or security features switched off. - Charges you do not recognise on a card or bank account. - Sharing you forgot about. Old location sharing or a shared cloud account can feel like spying. Apple's Safety Check and Google account settings help you review it. If someone controlling or abusive may be watching, think about your safety before removing access, and consider contacting a trusted person or a local support service. ## iPhone and Android: what differs **Android** lets you install apps from outside the official store if you allow it, so unwanted apps are more of a risk there. Play Protect, safe mode and the app list are your first tools. **iPhone** apps come through the App Store, so account compromise, shared access and scam messages are more common than a hidden app, and Safety Check is Apple's review tool. Apple also offers Lockdown Mode, which its guide describes as a hardening option for people who think they may be the target of a highly sophisticated attack. Most people do not need it. Neither platform is immune; keep both updated. ## Prevent it next time: a checklist - Keep the phone and apps updated. Updates fix known security flaws. - Install apps only from the official store, and delete ones you no longer use. - Keep Play Protect on (Android). - Review app permissions now and then. A torch app does not need your contacts. - Use a unique password for each account, ideally with a password manager. Check one with the [Password Strength](/tools/password-strength) tool. - Turn on two-step verification, and consider passkeys. See the [Passkey Lab](/tools/passkey-lab). - Never share a login code, and never call a number from a pop-up or text. - Set a screen lock and keep your SIM protected with your mobile provider's account PIN. - If an account is taken, see the [Account Takeover Lab](/tools/account-takeover-lab) to rehearse the steps. ## Frequently asked questions ### What are the signs that my phone is hacked? Signs worth acting on include apps you do not remember installing, login codes you did not request, accounts or settings changed without you, messages sent that you did not write, and a security setting switched off. Fast battery drain, heat or pop-ups alone often have ordinary causes, so look for more than one sign. ### Does fast battery drain mean my phone is hacked? Not by itself. Battery wear, a recent update, a bright screen and busy apps all drain power. Check the battery usage list in settings for an app you do not recognise before drawing a conclusion. ### Can a pop-up tell me my phone has a virus? No. A web page cannot scan your phone, so a pop-up announcing viruses is a scare tactic. Close it, do not tap it and do not call a number it shows. ### Can an iPhone be hacked? Yes, though unwanted apps are less common because iPhone apps come through the App Store. Accounts, shared access and scam messages are the more usual problems. Apple provides Safety Check to review what you share, and Lockdown Mode for people who may be targeted by sophisticated attacks. ### Will a factory reset remove a hacker? A reset removes everything on the phone, including apps installed without your knowledge, according to Apple's guide, and Google says it removes all data. It does not secure your accounts, so change passwords from a clean device too, and restore backups carefully. ### Who do I tell if money has gone missing? Phone your bank on the number printed on your card or on its official site. In the US the FTC says to report fraud at ReportFraud.ftc.gov, and to use IdentityTheft.gov if personal details were shared. ## Sources - [Google Android Help: Google Play Protect](https://support.google.com/android/answer/2812853) - [Google Android Help: Find problem apps by rebooting to safe mode](https://support.google.com/android/answer/7665064) - [Google Android Help: Reset your Android device to factory settings](https://support.google.com/android/answer/6088915) - [Apple Support, Personal Safety User Guide: Safety Check](https://support.apple.com/guide/personal-safety/ips2aad835e1) - [FTC Consumer Advice: How to recognize and avoid phishing scams](https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams) *This is general guidance, not legal advice. Menus and wording change by phone model and software version; follow the official help pages above for the current steps.*