How to Check Your iPhone for Spyware and Remove It

How to tell if spyware is running on your iPhone

Spyware on an iPhone usually shows itself through battery drain, overheating, unusual data use, or apps that crash repeatedly. Open Settings, then Battery, and look at Battery Usage. If an app you rarely use is consuming 20% or more of your battery, that is a warning sign. Check your data use in Settings > Cellular > Cellular Data to see if it spikes when you are not actively using your phone.

Listen to your phone during normal use. Spyware often causes the device to run hot even when you are not using it. If your iPhone gets warm while sitting idle, or if you hear the camera or microphone activating when no app is open, something is running in the background without your knowledge. Restart your phone and watch for the same behavior to return within hours.

Check your installed apps against what you remember downloading. Go to Settings > General > iPhone Storage and scroll through the full list. Spyware sometimes hides under names that look like system apps — for example, "System Update" or "Device Manager" when Apple does not use those names. If you see an app you do not recognize, tap it and note the developer name. Search that name online to see if it is legitimate.

Key Takeaways

Battery drain, overheating, and unexpected data use are the most common signs that spyware is running on your iPhone.
Restart your phone in Safe Mode by holding the power button, then sliding the power-off slider, then turning it back on — spyware often cannot run in this mode.
Remove any app you do not recognize from Settings > General > iPhone Storage, then restart your phone completely.
If the problem persists after removing suspicious apps, back up your data through iCloud and restore your iPhone to factory settings using a computer.
Spyware on iPhone is rare compared to Android, but it usually requires you to have installed it yourself or given someone physical access to your device.

Restart your iPhone in Safe Mode to stop spyware from running

Safe Mode prevents most third-party apps from launching, which stops spyware from executing while you investigate. Hold the power button on the side of your iPhone until the power-off slider appears. Do not swipe it yet. Release the power button, then hold it again until the screen goes black and you see the Apple logo. This takes about 10 seconds of holding after the logo appears. Your iPhone will boot into Safe Mode.

While in Safe Mode, open Settings > General > iPhone Storage again and look at your apps. Spyware that cannot run in Safe Mode will not show signs of activity — no battery drain, no overheating, no unexpected data use. If your phone behaves normally in Safe Mode but returns to the problem behavior when you restart normally, you have confirmed that an installed app is the culprit. Exit Safe Mode by holding the power button again and sliding the power-off slider, then turning the phone back on normally.

Remove unknown or suspicious apps

Go to Settings > General > iPhone Storage and look at the list of apps sorted by size. Tap any app you do not recognize or do not remember installing. Read the developer name and the description. If you still do not know what it is, search the developer name in a web browser on another device. Legitimate apps have websites, reviews, and clear purposes. Spyware often has vague descriptions or developer names that sound like system software but are not.

To remove an app, go back to Settings > General > iPhone Storage, tap the app, and tap Delete App. Confirm the deletion. Restart your iPhone completely by holding the power button and sliding the power-off slider, then turning it back on. After restart, check your battery use and data use again. If the drain stops, the app was the problem. If the problem continues, move to the next step.

Check your iCloud account for unauthorized access

Spyware sometimes works by syncing your data to an iCloud account that someone else controls. Go to Settings > [Your Name] > Password & Security and look at the list of devices signed into your account. You should recognize every device listed. If you see a device you do not own or do not remember using, tap it and select Remove from Account. This will sign that device out of your iCloud.

Next, go to Settings > [Your Name] > Password & Security > Password and change your Apple ID password to something long and unique. Use a combination of uppercase, lowercase, numbers, and symbols. Do not reuse a password you have used before. After you change your password, you will be signed out of iCloud on all devices. Sign back in on your iPhone with your new password. This locks out anyone who had your old password.

Restore your iPhone to factory settings if spyware persists

If you have removed suspicious apps, restarted in Safe Mode, and the problem behavior continues, the spyware may be embedded deeper in your system. The only reliable way to remove it is to erase your iPhone and restore it from a backup or set it up as new. Before you do this, back up your data to iCloud. Go to Settings > [Your Name] > iCloud > iCloud Backup and tap Back Up Now. Wait for the backup to complete — this can take 30 minutes or longer depending on how much data you have.

Connect your iPhone to a computer with a USB cable and open Finder (on Mac) or iTunes (on Windows). Select your iPhone in the sidebar. Click Restore and follow the prompts. Your iPhone will erase completely and install the latest version of iOS. When it restarts, you can choose to restore from your iCloud backup or set it up as a new device. If you restore from backup and the problem returns, the spyware was in your backup. In that case, set up as new and reinstall only the apps you need, one at a time, to identify which one is the problem.

Prevent spyware from being installed in the first place

Spyware on iPhone almost always requires you to have installed it yourself or given someone physical access to your device. Do not install apps from anywhere except the App Store. Do not click links in text messages or emails that ask you to install a profile or update your device — Apple handles all updates through Settings > General > Software Update. Do not give your phone to someone you do not trust, and do not share your Apple ID password with anyone.

If you suspect someone has physical access to your device, change your Apple ID password when ready and enable two-factor authentication. Go to Settings > [Your Name] > Password & Security and turn on Two-Factor Authentication. This means anyone trying to sign into your account from a new device will need a code that appears on your trusted devices. Review your trusted devices regularly and remove any you do not recognize.

When to contact Apple Support

If you have removed suspicious apps, restored your iPhone from backup, and the problem behavior continues, contact Apple Support. Go to support.apple.com, select your iPhone model, describe the problem, and request a callback or chat session. Have your Apple ID password ready. Apple Support can review your account for unauthorized access and help you determine whether the problem is spyware or a hardware issue like a failing battery.

If you believe someone has stolen your Apple ID password or has physical access to your device, tell Apple Support when ready. They can lock your account, review your account activity, and help you find it. Do not wait to see if the problem goes away on its own.

Frequently Asked Questions

Can spyware hide from Safe Mode?

Most spyware cannot run in Safe Mode because Apple restricts third-party apps. However, some sophisticated spyware embedded at the system level might persist. If your phone behaves normally in Safe Mode but the problem returns when you restart normally, you have identified a third-party app as the culprit and can remove it.

Will restoring from an iCloud backup reinfect my iPhone?

If the spyware was installed as an app, restoring from backup will not reinfect your phone because the app itself is not in the backup — only your data is. If the problem returns after restore, the spyware was likely in your backup data or you reinstalled the malicious app. Set up your iPhone as new and reinstall apps one at a time to identify the problem.

Is spyware common on iPhone?

Spyware on iPhone is much less common than on Android because Apple controls what can be installed and how apps run. Most spyware on iPhone requires you to have installed it yourself, often disguised as a legitimate app, or requires someone to have physical access to your device and your Apple ID password.

What should I do if I think someone is monitoring my phone?

Change your Apple ID password when ready, enable two-factor authentication, and review your trusted devices in Settings > [Your Name] > Password & Security. Remove any device you do not recognize. Then follow the steps above to check for suspicious apps and restore your iPhone if needed. If you believe someone has physical access to your device, keep it with you at all times.

Can I remove spyware without erasing my iPhone?

If the spyware is installed as an app, you can remove it by deleting the app from Settings > General > iPhone Storage. If the problem persists after removing all suspicious apps and restarting in Safe Mode, erasing and restoring your iPhone is the most reliable way to remove spyware that has embedded itself deeper in your system.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.