How to Know If Your Phone Has Been Hacked: 7 Signs and What to Do
Any mobile phone can be hacked — Android and iPhone alike. The problem is that the signs are usually subtle: battery lasts less, data runs out faster than usual, an app appears that you don't remember installing. Most users attribute it to a system failure or the phone being old. This post explains how to identify if your mobile has been compromised and what to do if you confirm something is wrong.
7 signs your mobile is hacked
- Battery drains much faster than normal — malware runs background processes continuously. If your battery has started to last significantly less without changes in your normal usage, it's a sign to investigate.
- Mobile data spikes without explanation — malicious apps send data to external servers constantly. Check data consumption by application in your phone's settings — if there's an app with unusually high consumption that you don't recognize, it's a red flag.
- Apps appear that you don't remember installing — one of the clearest signs. Some types of malware install additional applications to maintain access to the device. Review the complete list of installed apps.
- Phone heats up when not in use — if the device generates heat when idle and with the screen off, something is running in the background without your knowledge.
- Strange behavior — screen turns on by itself, you receive SMS messages you didn't send, your contacts receive strange messages from your number, or the phone takes longer than normal to turn off or restart.
- Your passwords stop working — if you can't access an account from your phone with a password you know is correct, someone may have changed the credentials after accessing your account.
- Activity on your accounts from unknown locations — check login history in Google, Apple ID, social media and email. Logins from countries or cities where you haven't been are an unmistakable sign of compromise.
How to confirm if your mobile is hacked
The above signs are indicators — not proof. These steps help you confirm whether there is unauthorized activity on the device.
Android: Settings → Network → Data usage → View breakdown by app. iPhone: Settings → Mobile data → scroll down to see consumption by app. Any unknown app with high consumption is suspicious.
Look for apps you don't recognize, especially those without a visible icon on your home screen. On Android, go to Settings → Apps → View all. On iPhone, swipe right from your home screen to open the app library.
Android: Settings → Privacy → Permission manager. iPhone: Settings → Privacy and security. Review which apps have access to microphone, camera, location and contacts — especially apps that shouldn't need those permissions.
Google: myaccount.google.com → Security → Your devices.
Apple: Settings → your name → scroll down to see connected devices. Remove any device you don't recognize.
Some attacks activate call forwards to intercept SMS codes. Dial *#21# in the phone app to see if there are any active forwards. If any appear that you didn't set up, dial ##21# to disable them.
ℹ️ USSD codes for detecting call forwards
*#21# — shows if there are active call, SMS or data forwards.
*#62# — shows what number calls are forwarded to when you don't answer.
##21# — disables all call forwards.
They work with most operators in Spain. Dial them from the phone app like a normal number.
What to do if your mobile is hacked
Don't do it from the compromised phone — malware can capture what you type. Use a computer or a different phone. Start with email, which is the master key to all your other accounts.
Even if someone has your password, the second factor prevents them from accessing. Use an authentication app or a physical FIDO2 key — not SMS, which can be intercepted by SIM swapping.
Uninstall any app you don't recognize. On Android, some malicious apps have device administrator permissions — go to Settings → Security → Device administrators before trying to uninstall them.
Many attacks exploit vulnerabilities in older system versions. Make sure you have the latest available version of Android or iOS installed.
Factory reset removes any installed malware. Back up your photos and contacts first. After resetting, don't restore an old backup — install apps manually to avoid reimporting the malware.
If you suspect your accounts have been accessed in addition to your phone, also check our guide on how to erase your digital footprint from the internet →
How to prevent your mobile from being hacked
- Keep the operating system updated — security updates fix active vulnerabilities. Enable automatic updates.
- Don't install apps outside the official store — on Android, disable the option to install apps from unknown sources if you don't actively need it.
- Review permissions before installing an app — a flashlight app that asks for access to your contacts and microphone is a red flag.
- Don't connect to public WiFi without a VPN — open networks allow you to intercept unencrypted traffic. Use a VPN or stick to mobile data on unknown networks.
- Enable 2FA on your main accounts — even if someone accesses your phone, they can't get into your accounts without the second factor.
- Use a password manager — unique passwords per service limit the damage if one account is compromised.
YOU MAY BE INTERESTED
What is 2FA and how to protect your accounts with YubiKey?
Frequently asked questions
Can an iPhone be hacked?
Yes. iOS is more closed than Android, which reduces the attack surface, but doesn't eliminate it. iPhone attacks usually come through phishing, malicious apps slipped into the App Store, or zero-day vulnerabilities. Having an iPhone doesn't guarantee protection if you don't follow good security practices.
How do I know if someone has access to my camera or microphone?
On iOS 14 or later, an orange dot appears when an app uses the microphone and a green dot when it uses the camera. On Android 12 or later, a similar indicator appears in the status bar. If you see these indicators when you're not using any app that needs them, check permissions immediately.
Does factory reset remove all viruses?
In practice, yes for the vast majority of cases. There is very sophisticated malware that persists in the device's firmware, but it's extremely rare and doesn't affect regular users. A standard factory reset is sufficient to remove any conventional malware.
Do I need antivirus software on my phone?
On iPhone, no — iOS doesn't allow third-party apps to scan the system in the way needed for real antivirus. On Android, antivirus from a recognized brand can add an extra layer of protection, especially if you install apps outside Google Play. But it doesn't replace keeping your system updated and using strong passwords.
Does SIM swapping affect any carrier?
Yes. SIM swapping — duplicating your SIM card to receive your SMS — is possible with any carrier. That's why 2FA via SMS is the least secure method. An authentication app or a physical FIDO2 key don't depend on the SIM and are not vulnerable to this attack.
CONCLUSION
The signs are there — most people ignore them
Battery that lasts less, data that runs out on its own, unknown apps. They are signs that most people attribute to phone wear and tear. In many cases it is that — but sometimes it isn't.
Checking data consumption by app, granted permissions and recent access to your accounts takes less than ten minutes and can give you a clear answer. If you find something suspicious, act quickly: change passwords from another device and enable 2FA before doing anything else.
