Signs that suggest your iPhone may have been compromised
A hacked iPhone typically shows one or more of these patterns: the battery drains much faster than usual even when you are not using it, your data usage spikes without explanation, apps crash repeatedly or open on their own, your phone runs hot, or you see unfamiliar apps you did not install. You might also notice your contacts receiving messages you did not send, your email or social media passwords no longer working, or pop-ups appearing constantly.
None of these signs by itself proves your phone is hacked — a battery drain can mean a worn-out battery, and high data usage can come from a single app syncing photos. But if you see several of these together, or if one of them started suddenly after you clicked a suspicious link or downloaded something unusual, it is worth investigating.
Key Takeaways
- Battery drain, unexpected data usage, and repeated app crashes are the most common signs that something is wrong with your iPhone.
- Check your Settings app for unfamiliar sign-ins, review your App Library for apps you do not remember installing, and look at your iCloud activity for logins from unknown devices.
- If you find evidence of a breach, change your Apple ID password when ready from a different device, then turn off two-factor authentication temporarily to regain control of your account.
- Restoring your iPhone from a backup made before the problem started can remove many threats, but a full factory reset is more thorough if you suspect serious compromise.
Where to look for unfamiliar activity in Settings
Open Settings and go to your name at the top, then tap Password & Security. Scroll down to Security Key and look at Where You're Signed In. This shows every device currently logged into your Apple ID. If you see a device you do not recognize — especially one in a city you have never visited — that is a red flag. Tap it and select Remove from Account.
Next, go back to Settings and tap Privacy. Scroll through each section — Location Services, Contacts, Photos, Microphone, Camera — and look for apps that have permission but should not. A weather app does not need access to your contacts. A flashlight app does not need location data. Revoke permissions that do not make sense for what the app does.
Finally, check Settings > General > iPhone Storage and scroll through the full list of installed apps. Look for anything you do not recognize or remember downloading. Unfamiliar apps with generic names like "System Update" or "Settings Helper" are particularly suspicious.
Checking your iCloud account for unauthorized access
Go to Settings > [Your Name] > Password & Security > Security Key again and look at the full list of devices. Apple shows the device type, model, and approximate location of the last sign-in. If you see an iPad, Mac, or iPhone you do not own, or a sign-in from a country where you have never been, someone else has your Apple ID password.
You can also check this from any web browser by visiting appleid.apple.com, signing in, and looking at Devices. The web view sometimes shows more detail about when and where each device last connected. Remove anything that is not yours.
What to do if you find signs of compromise
Start by changing your Apple ID password from a different device — a computer or a friend's phone — not from the iPhone you suspect is compromised. Go to appleid.apple.com, sign in, and choose Password & Security > Change Password. Use a password you have never used before, at least 16 characters long, mixing uppercase, lowercase, numbers, and symbols.
After you change your password, go back to your iPhone and sign out of iCloud. Go to Settings > [Your Name] > Sign Out. You will be asked whether to keep or delete data on your phone — choose Keep on My iPhone so you do not lose your photos and messages. Then sign back in with your new password. This forces out any unauthorized access.
Change the passwords for any accounts that matter — email, banking, social media — from a different device. If your email password was compromised, someone can reset passwords for everything else, so email is the priority.
Restoring your iPhone to remove malware
If you have confirmed unauthorized access or installed something you cannot identify and remove, the most reliable fix is to restore your iPhone. You have two options: restore from a backup made before the problem started, or do a complete factory reset.
To restore from a backup, connect your iPhone to a computer with Finder (Mac) or iTunes (Windows), select your phone, and choose Restore. You will be asked to pick a backup to restore from — choose the oldest one that is older than when the problem began. This removes the malware but keeps your data.
A factory reset is more thorough. Go to Settings > General > Transfer or Reset > Erase All Content and Settings. Your phone will restart and ask you to set it up as new. You can then restore from a backup, or set it up manually without restoring anything. A factory reset followed by manual setup is the most find option if you are very concerned, but it means re-entering passwords and reconfiguring apps.
Steps to take after you have secured your phone
Once you have changed your Apple ID password and removed unauthorized devices, enable two-factor authentication if it is not already on. Go to Settings > [Your Name] > Password & Security and make sure Two-Factor Authentication is enabled. This means anyone trying to sign into your account from a new device will need a code from one of your trusted devices.
Review your email forwarding rules. Go to appleid.apple.com, sign in, and check Account > Email and Phone Numbers. Make sure no extra email addresses are listed and no forwarding rules are active. Attackers sometimes add a recovery email address so they can regain access later.
Check your payment methods. Go to Settings > [Your Name] > Payment & Shipping and make sure only your credit cards are listed. Remove anything you do not recognize. If you are concerned about charges, contact your bank or credit card company directly.
When to consider your phone beyond repair
If you restore your iPhone and the same problems return within days, or if you find evidence that someone accessed your accounts even after you changed your password, your phone may have a persistent infection that a standard restore cannot remove. This is rare on iPhone — Apple's security model makes it difficult for malware to survive a full factory reset — but it can happen.
In that case, your options are to do a complete factory reset and set up as new without restoring any backup, or to contact Apple Support to discuss whether a hardware replacement is necessary. If you choose the factory reset route, you will need to re-enter all your passwords and reconfigure your apps, but you will have a clean phone.
Frequently Asked Questions
Can someone hack my iPhone just by having my phone number?
Not directly. However, if someone has your phone number and knows your Apple ID email, they can try to reset your Apple ID password and take over your account. This is why you should enable two-factor authentication — it requires a code from one of your trusted devices, not just your phone number. If you are concerned, change your Apple ID password and review your trusted devices when ready.
Does visiting a suspicious website hack my iPhone?
Visiting a website alone is very unlikely to hack your iPhone. Safari blocks most malicious code automatically. However, if a website tricks you into downloading an app or profile, or if you tap a link that prompts you to enter your Apple ID password, that can lead to compromise. Never enter your Apple ID password unless you initiated the sign-in yourself.
Will restarting my iPhone remove a hack?
Restarting can temporarily slow down some malware, but it will not remove it. Most hacks survive a restart because they are stored on your phone's storage, not just in memory. A restart is a good first step if your phone is running slowly, but if the problems continue, you will need to restore or factory reset your phone.
Is my iPhone hacked if I see an app I do not remember downloading?
Not necessarily. You may have downloaded it months ago and forgotten, or a family member with access to your Apple ID may have installed it. Go to Settings and check who is signed into your Apple ID. If only you are signed in, review the app's permissions and decide whether to keep it. If someone else is signed in, remove them and change your password.
What if I think my Apple ID password was stolen but I cannot sign in to change it?
Go to iforgot.apple.com and choose Forgot Apple ID or password. You will be asked to verify your identity using your phone number, recovery email, or security questions. Once verified, you can reset your password. If you cannot verify your identity that way, contact Apple Support — they can help you regain access to your account.