What to look for in your iPhone settings when you think you've been hacked

If your iPhone has been hacked, the Settings app often shows the damage before anything else does. Start by opening Settings and looking for unfamiliar accounts, unexpected location access, or apps you don't remember installing. Most hacks don't hide perfectly — they leave traces in the places iOS uses to manage permissions, accounts, and device behavior.

The most common signs appear in three places: under Accounts (where email and cloud services connect), under Privacy (where apps request access to your location, contacts, or camera), and under General > VPN & Device Management (where unauthorized profiles can hide). A hacked phone often shows an account you didn't add, an app with permission to your location at all times, or a mysterious configuration profile installed by someone else.

This guide walks you through the specific settings screens to check and what each one means. It covers what you can see yourself and when you should contact Apple Support or a technician instead.

Key Takeaways

  • Check Settings > Accounts to see if unfamiliar email accounts or cloud services are signed in without your knowledge.
  • Look in Settings > Privacy to find apps with constant location access, camera access, or microphone access that you didn't authorize.
  • Go to Settings > General > VPN & Device Management to spot unauthorized configuration profiles, which are a common sign of a serious compromise.
  • If you find something suspicious, change your Apple ID password when ready from a different device, then sign out of that account on your iPhone.
  • Some hacks hide in ways Settings cannot show — if you see unusual behavior but find nothing in settings, back up your data and consider a factory reset or contacting Apple Support.

Check your accounts for unauthorized sign-ins

Open Settings and scroll down to find Accounts (the exact name varies by iOS version — it may say "Mail" or "Passwords and Accounts" on older phones). Tap it and look at every account listed. You should recognize every single one. If you see an email address, iCloud account, or cloud service you didn't add, that is a red flag.

Pay special attention to iCloud accounts. If someone has added a second Apple ID to your phone, they can see your photos, messages, and location. Tap any account you don't recognize and select "Delete Account" — iOS will ask whether to keep or delete the data associated with it. Choose "Delete from My iPhone" to remove it completely.

Also check Settings > Mail > Accounts. If you see an email account you didn't set up, remove it the same way. Hackers sometimes add their own email to intercept password reset messages or two-factor codes.

Review app permissions in Privacy settings

Go to Settings > Privacy and check each category: Location Services, Contacts, Calendar, Reminders, Photos, Camera, Microphone, and Health. Tap each one and look for apps with access you don't remember granting. Pay closest attention to Location Services — if an app you rarely use has "Always" access to your location, that is unusual and worth investigating.

Tap any suspicious app and change its permission to "Never" or "Only While Using." You can always change it back later if the app genuinely needs it. If you see an app with camera or microphone access that you don't use, remove that permission when ready.

Some legitimate apps need these permissions — Maps needs location, Messages may need contacts, your camera app needs camera access. The goal is to spot things that don't make sense. A weather app that has "Always" location access, or a flashlight app with microphone permission, suggests something is wrong.

Look for unauthorized configuration profiles

This is where serious hacks often hide. Go to Settings > General and scroll down to find "VPN & Device Management" (on older iOS versions it may say just "Device Management" or "Profiles"). Tap it. If you see anything listed here that you didn't install yourself, that is a major warning sign.

Configuration profiles are files that change how your iPhone behaves — they can redirect your internet traffic, install root certificates, or change security settings. Legitimate profiles come from your employer (if you use a work phone), your school, or a VPN service you paid for. If you see a profile from an unknown source, or one you don't remember installing, tap it and select "Remove Profile."

If the phone asks for a password to remove a profile and you don't know it, that confirms someone else installed it. In that case, you will need to either contact whoever installed it (your employer, your school) or perform a factory reset. Do not ignore this — an unauthorized profile is a serious compromise.

Check for unexpected VPN or proxy settings

While you are in Settings > General > VPN & Device Management, also look at the VPN section. If a VPN is turned on and you didn't turn it on, that is suspicious. Some hacks use a VPN to route your traffic through a server the attacker controls, letting them see your passwords and messages.

Tap the VPN and look at its settings. You should recognize the VPN service name — it should be something like ExpressVPN, NordVPN, or Proton VPN if you subscribed to one yourself. If it is something unfamiliar or has no name, remove it by tapping the info icon and selecting "Delete VPN."

Also check Settings > Wi-Fi, tap the network you are connected to, and look at the "HTTP Proxy" setting. It should say "Off." If it says "Manual" or "Auto," someone may have configured a proxy to intercept your traffic. Change it back to "Off."

Look at recently installed apps and app updates

Go to Settings > General > iPhone Storage. This shows every app on your phone, sorted by size. Scroll through the list and look for apps you do not recognize. Hackers sometimes install apps that hide themselves by using names similar to real apps — for example, "Setings" instead of "Settings," or a generic name like "System Update."

If you find an app you do not recognize, tap it and select "Delete App." If the phone refuses to delete it and says it is a system app, that is unusual — most system apps cannot be deleted. If you cannot remove it, that suggests a deeper compromise and you should consider a factory reset or contact Apple Support.

Also check Settings > General > iPhone Storage and look at the "Last Used" date for each app. If an app you never use shows a recent "Last Used" date, someone else may have opened it. This is not definitive proof of a hack, but combined with other signs, it is worth investigating.

Check your Apple ID and iCloud settings

Go to Settings > [Your Name] at the top. This is your Apple ID settings page. Look at "Devices" and you should see only the iPhones, iPads, and Macs you own. If you see a device you do not recognize, tap it and select "Remove from Account." This will sign out your Apple ID on that device.

Also check "Password and Security" and look at "Where You're Signed In." Again, you should recognize every device listed. If you see a device you do not own, tap it and select "Remove." Then change your Apple ID password when ready — use a different device to do this, not the iPhone you are checking.

Look at "Trusted Phone Numbers" under "Password and Security." These are the phone numbers that can receive two-factor codes. If you see a number that is not yours, remove it. If someone added their own number here, they can intercept your security codes.

What to do if you find signs of a hack

If you found something suspicious in your settings, take these steps in order. First, change your Apple ID password when ready using a different device — a computer, tablet, or a friend's phone. Do not use the iPhone you are checking. Go to appleid.apple.com, sign in, and change your password to something long and random.

Second, sign out of your Apple ID on the compromised iPhone. Go to Settings > [Your Name] and scroll to the bottom, then tap "Sign Out." iOS will ask what to do with your data — choose "Keep on My iPhone" so you do not lose anything. Then sign back in with your new password.

Third, remove any suspicious accounts, apps, or profiles you found. If you cannot remove something, or if you found an unauthorized configuration profile with a password you do not know, you will need to perform a factory reset. This erases everything on your phone, so back up your data first using iCloud or a computer.

If the hack is serious — for example, you found an unauthorized profile you cannot remove, or your phone is behaving very strangely despite finding nothing in settings — contact Apple Support or visit an Apple Store. A technician can check for compromises that do not show up in the settings you can see.

When settings look clean but something still feels wrong

Some hacks are sophisticated enough to hide from the settings screens you can access. If you checked everything above and found nothing, but your phone is still behaving oddly — apps crashing, battery draining fast, unexpected data usage, or strange pop-ups — the problem may be deeper.

In this case, your options are limited. You can try a factory reset: go to Settings > General > Transfer or Reset > Erase All Content and Settings. This completely wipes your phone and reinstalls iOS fresh. Before you do this, back up your data to iCloud or a computer so you can restore it afterward. A factory reset will remove most hacks, but it will also delete everything on your phone if the backup fails.

Alternatively, contact Apple Support or visit an Apple Store and describe what you are seeing. Bring your phone with you. A technician has tools to check for compromises that you cannot see in settings, and they can advise whether a reset is necessary.

Frequently Asked Questions

Can I tell if someone is reading my messages without checking settings?

Not reliably from settings alone. If someone has access to your Apple ID, they can read your messages through iCloud on another device without leaving a trace in your iPhone settings. Check your Apple ID devices list (Settings > [Your Name] > Devices) to see if an unfamiliar device is signed in. If you see one, remove it and change your password when ready.

What does it mean if I see a VPN I didn't install?

It means someone else configured your phone to route your internet traffic through their server. This lets them see your passwords, messages, and browsing. Remove it when ready by going to Settings > General > VPN & Device Management, tapping the VPN, and selecting "Delete VPN." Then change your Apple ID password from a different device.

Is a configuration profile always a sign of a hack?

No. If you work for a company or attend a school that manages iPhones, they install profiles to enforce security rules. You should recognize where the profile came from. If you see a profile from an unknown source, or one you definitely did not authorize, remove it. If you cannot remove it because it requires a password, contact your IT department or perform a factory reset.

Should I factory reset my iPhone if I find something suspicious?

Not when ready. First, remove any suspicious accounts, apps, or profiles you can access. Change your Apple ID password from a different device. If you found an unauthorized profile with a password you cannot remove, or if your phone is behaving very strangely despite finding nothing suspicious, then a factory reset makes sense. Back up your data first.

What if I cannot remove an app or profile from settings?

If iOS refuses to let you delete an app or profile, that suggests a serious compromise. Some malware locks itself in place. Your options are to contact Apple Support for help, or to perform a factory reset. Do not ignore this — if you cannot remove something, it may be actively harming your security.