How to recognize a hacked phone

A hacked phone usually shows one or more of these signs: it runs slowly even after restart, the battery drains much faster than normal, you see unfamiliar apps you did not install, or your data usage spikes without explanation. You may also notice your phone getting hot during normal use, or receiving texts about password reset attempts you did not make. These are not proof of a hack on their own — a slow phone is often just old — but several together suggest someone has gained access.

The most reliable sign is a text or email from a service you use (your bank, email provider, social media account) saying someone tried to log in from an unfamiliar location or device. That message came from the real company, not a scammer, because they only send it when their servers detect the attempt. If you did not make that attempt, someone with your password is trying to get in, which usually means your phone was compromised first.

Key Takeaways

  • A hacked phone often shows multiple signs at once: slow performance, fast battery drain, unfamiliar apps, or sudden data usage spikes.
  • Login attempt notifications from your real bank or email provider are the strongest sign that someone has your passwords and is trying to use them.
  • The fastest response is to change your passwords from a different device (a computer or tablet), starting with email and banking accounts.
  • Restarting your phone in safe mode lets you see which apps are running and remove suspicious ones before they can hide themselves.
  • If you cannot remove malware yourself, a factory reset erases everything on the phone, including the malware, but you lose all your data unless you backed it up first.

Check what apps are running and what permissions they have

Open your phone's Settings and go to Apps (on Android) or General > iPhone Storage (on iPhone). Look for apps you do not remember installing. Malware often hides under names that sound like system apps — something like "System Update" or "Google Play Services" that is not the real thing. If you see an app you do not recognize, tap it and look at the install date. If it appeared around the time your phone started acting strange, that is suspicious.

Next, check what permissions each app has. On Android, go to Settings > Apps > Permissions and look for apps that have access to your camera, microphone, location, or contacts without a clear reason. A flashlight app does not need your location. A calculator does not need your camera. On iPhone, go to Settings > Privacy and check each category (Camera, Microphone, Location) to see which apps can use them. Remove permission from any app that should not need it, or uninstall the app entirely if you do not use it.

Restart your phone in safe mode to see hidden apps

Malware often hides itself by running in the background where you cannot see it during normal use. Restarting in safe mode disables all third-party apps, so only the phone's built-in system apps run. If your phone suddenly works normally in safe mode, that is strong evidence malware is installed.

On Android, press and hold the power button until you see the power menu, then press and hold "Power off" until safe mode appears. On iPhone, press and hold the side button and volume button together, drag to power off, wait 30 seconds, then press the side button again until you see the Apple logo — this boots into safe mode. While in safe mode, go back to your Apps list and look for anything unfamiliar. If you find a suspicious app, uninstall it. Then restart normally and check whether your phone runs better.

Change your passwords from a different device

If your phone is hacked, changing your password on that same phone does not help — the malware can see the new password as you type it. Instead, use a computer, tablet, or a friend's phone to change your passwords. Start with your email account, because email is the master key to everything else: if someone controls your email, they can reset passwords for your bank, social media, and other accounts.

Go to your email provider's website (Gmail, Outlook, Yahoo, or whatever you use), sign in, and look for "Security" or "Account settings". Change your password to something long and random that you have never used before. Then do the same for your bank, any financial accounts, and social media. Use a different password for each one. If you use a password manager like Bitwarden or 1Password, change that password too, then update all your other passwords through the manager so they are all different and strong.

Turn off automatic login and check connected devices

After you change your passwords, go back into each account's security settings and look for a section called "Active sessions", "Connected devices", "Where you are signed in", or "Manage your Google Account". You will see a list of devices and locations where you are currently signed in. If you see a device you do not own or a location you have never been to, sign that session out when ready. This forces the hacker to sign back in with the new password you just created, which they do not have.

While you are in security settings, turn off "Remember this device" or "Stay signed in" if those options are available. This means you will have to enter your password more often, but it also means a hacker cannot stay logged in indefinitely. Check this list again in a few days. If new unknown devices keep appearing, your phone is still compromised and you should move to a factory reset.

Factory reset your phone if malware will not go away

If you have removed suspicious apps, changed all your passwords, and your phone still shows signs of being hacked — slow performance, unexpected data usage, login attempts you did not make — a factory reset is the most reliable fix. A factory reset erases everything on your phone and reinstalls the operating system, which removes any malware that has burrowed deep into the system.

Before you reset, back up your important data. On Android, go to Settings > System > Backup and make sure your photos, contacts, and messages are backed up to Google Drive or another cloud service. On iPhone, go to Settings > [Your Name] > iCloud and turn on iCloud Backup, then plug in and connect to Wi-Fi so the backup completes. After backup is done, go to Settings > System > Reset options (Android) or Settings > General > Transfer or Reset (iPhone) and choose "Erase all content and settings". The phone will restart and ask you to set it up again as if it were new. Sign back in with your email and the new passwords you created, and your data will restore from the backup.

Prevent future hacks with these basic steps

After you have cleaned your phone, take steps to keep it from being hacked again. Use a strong password or biometric lock (fingerprint or face) on your phone itself, so someone cannot physically access it. Turn on two-factor authentication for your email and banking accounts — this means even if someone steals your password, they cannot sign in without a code sent to your phone or generated by an app like Google Authenticator.

Keep your phone's operating system and apps updated. Go to Settings > System > System update (Android) or Settings > General > Software Update (iPhone) and install updates as soon as they are available. Updates patch security holes that hackers use to break in. Do not install apps from anywhere except the official app store for your phone — the Google Play Store for Android or the App Store for iPhone. Third-party app stores are common sources of malware. Finally, be cautious about what you tap: do not click links in text messages or emails from unknown senders, and do not grant permissions to apps unless you understand why they need them.

Frequently Asked Questions

Can I tell if someone is reading my text messages?

Not reliably from the phone itself. If your phone shows signs of being hacked — slow performance, fast battery drain, unfamiliar apps — then someone may have access to your messages. The clearest sign is a login attempt notification from your email or messaging service saying someone tried to sign in from an unfamiliar device. If you see that, change your password when ready from a different device.

What if I see an app I do not remember installing?

Uninstall it. Go to Settings > Apps, find the app, tap it, and choose Uninstall. If the uninstall button is grayed out, the app may be a system app that came with your phone, or malware that has hidden itself. Try restarting in safe mode and uninstalling from there. If it still will not uninstall, note the app's name and consider a factory reset if your phone continues to show other signs of being hacked.

Does my phone need antivirus software?

Modern phones (Android and iPhone) have built-in security that is usually enough. Antivirus apps from the app store add little protection and often slow your phone down. If you are concerned about malware, focus on the steps above: keep your operating system updated, install apps only from the official store, and be careful what you tap. If your phone is already hacked, antivirus software usually cannot remove deep malware — a factory reset is more reliable.

What should I do if I cannot access my email account?

If a hacker has locked you out of your email, go to the email provider's login page and look for "Can't sign in?" or "Forgot password?". Follow the recovery process, which usually involves answering security questions or confirming your identity through a phone number or backup email. If you cannot recover the account yourself, contact the email provider's support team directly. Do not use a phone number or email address the hacker may control — use a different contact method if possible.

Is it safe to use my phone after a factory reset?

Yes. A factory reset removes malware completely because it erases and reinstalls the operating system. After reset, your phone is clean. To keep it that way, use strong passwords, turn on two-factor authentication, keep your operating system updated, and install apps only from the official app store. If you restore from a backup that was made while your phone was hacked, you may restore the malware too — so if you are unsure when the hack started, set up your phone as new and manually reinstall only the apps you need.