How to know if your phone is hacked — signs, fixes, and prevention

The short version: a genuinely hacked phone typically shows a cluster of symptoms, not just one. The single strongest indicator isn't "my phone is slow" — it's unexpected account activity you didn't initiate (password reset emails you didn't request, two-factor codes arriving unprompted, login alerts from locations you've never been). If you see that, skip to the "what to do" section below. If you're here because your battery drains fast or your phone feels sluggish, the honest answer is that those symptoms almost never mean you're hacked — but we'll walk through the full diagnostic so you can rule it out properly.

The diagnostic table: symptoms, likely causes, and when to worry

Before diving into detail, here's the reference table. Most symptoms people associate with hacking have mundane explanations. The right column tells you when the same symptom actually is a red flag.

The pattern to watch for: a single symptom is almost never enough. Real compromises typically produce a cluster — unexpected data usage plus battery drain plus an app you don't recognize, or account activity plus 2FA codes you didn't request. If you're experiencing only one item from the left column with no corroborating evidence, the mundane explanation is overwhelmingly more likely.

Signs your phone might actually be hacked

These are the indicators that security professionals take seriously — the ones where the probability of a real compromise is high enough to justify immediate investigation.

1. Account takeover signals

You receive password reset emails you didn't request. You get 2FA verification codes via SMS or authenticator app that you didn't trigger. You see login alerts from devices or locations you don't recognize. Your email's "sent" folder contains messages you didn't write. Your social accounts post content you didn't create. This is the highest-confidence indicator — it means either your credentials are compromised (which may or may not involve your phone) or something on your device is intercepting authentication flows.

2. Unexplained app installations with elevated permissions

On Android: go to Settings, then Apps, then sort by recently installed. Look for anything you don't recognize. Then check Settings, then Security, then Device admin apps — if an app you didn't install has device administrator privileges, that's a serious red flag. On iOS: look through your home screen for unfamiliar apps and check Settings, then General, then VPN & Device Management for any configuration profiles you didn't install. Stalkerware and spyware almost always require elevated permissions to function — device admin on Android, configuration profiles on iOS.

3. Data exfiltration patterns

Check your data usage breakdown by app (Settings, then Cellular on iOS; Settings, then Network & internet, then Data usage on Android). If an app you rarely use is consuming hundreds of megabytes — or if "System Services" or an unidentifiable process is using significant data — that's worth investigating. Malware that exfiltrates photos, messages, or call recordings needs to upload that data somewhere, and the upload shows in the data stats.

4. Unauthorized financial activity

Charges on your phone bill for premium SMS services or international calls you didn't make. Transactions on payment apps (Venmo, Cash App, Apple Pay, Google Pay) you didn't authorize. This is often the first concrete sign people notice because it has a dollar amount attached. If your phone bill shows premium-rate SMS charges to short codes, that's a strong indicator of SMS-sending malware.

5. Your phone does things when you're not touching it

The screen lights up and navigates on its own. Apps open without your input. Settings change — WiFi turns on, Bluetooth enables, airplane mode toggles. If someone has remote access to your device (via a RAT — remote access trojan), the device will occasionally betray that by performing actions without physical input. This is rarer than it used to be because modern mobile RATs are better at staying invisible, but when it happens, it's unmistakable.

Signs that seem suspicious but usually aren't

The internet is full of "15 signs your phone is hacked" articles that include symptoms so common they apply to virtually every phone. Let's be honest about what these actually mean.

"My phone is slow" — almost certainly not a hack

A phone with 90% storage used, 47 apps with background refresh enabled, and an 18-month-old battery will feel slow. That's physics, not malware. Modern mobile malware is engineered to be lightweight — a keylogger or credential stealer uses negligible CPU because the attacker wants to stay hidden. If malware made your phone noticeably slow, it would be poorly written malware that gets detected fast. The sophisticated stuff is invisible to performance monitoring.

"My battery drains fast" — check your battery health first

On iOS: Settings, then Battery, then Battery Health & Charging. If Maximum Capacity is below 80%, your battery is degraded and that explains the drain. On Android: Settings, then Battery, then Battery usage shows which apps consumed the most. Background location services (weather apps, fitness trackers, navigation apps that didn't close properly) are the top battery killers. If Battery Health is above 90% and no single app explains the drain, then you have something worth investigating — but start by restarting the phone and monitoring for a day before assuming compromise.

"I see targeted ads" — that's just the ad ecosystem working

Seeing an ad for something you talked about near your phone feels like surveillance, and it's the most common trigger for "I think I'm hacked" searches. The reality: your phone is not listening to your conversations through the microphone for ad targeting. That would require constant audio processing, would drain battery visibly, and would generate detectable network traffic. What is happening is that ad networks are extraordinarily good at inferential targeting — they know your location, your browsing history, your purchase history, your social graph, and the behavior of people demographically similar to you. That's enough to produce ads that feel psychically accurate. It's creepy, but it's not hacking. It's the business model. Tracker blocking addresses this by cutting off the data collection that feeds the ad network's inference engine.

"Random pop-ups" — probably browser notifications, not malware

At some point you visited a website and tapped "Allow" on a notification permission prompt. Now that site sends push notifications that look like pop-ups. The fix: on iOS, go to Settings, then Safari, then Advanced, then Website Data and clear it, or manage notifications per-site. On Android, open Chrome, then Settings, then Notifications, then Sites and revoke any you don't recognize. These are annoying but they're not evidence of compromise — they're a feature of the web notification API being abused by aggressive sites.

What to do if you think your phone is hacked

If you've identified a genuine cluster of suspicious indicators from the section above, here's the step-by-step response. The order matters — do these sequentially, not in parallel.

Step 1: Disconnect and preserve evidence

Put your phone in airplane mode. This stops any active data exfiltration and cuts the attacker's remote access. Before you do anything else, take screenshots of: the suspicious apps, the data usage breakdown, any unusual account alerts, and your recent call/SMS logs. If this turns into a law enforcement matter or an insurance claim, you'll want the evidence.

Step 2: Change critical passwords from a different device

Using a computer or another phone you trust, change passwords for: your email (this is the master key — most password resets go through email), your bank, your Apple ID or Google account, and any account where you've seen suspicious activity. Enable two-factor authentication everywhere it's offered. Do not do this from the potentially compromised phone — if a keylogger is present, you'd be handing over the new passwords too.

Step 3: Check for and remove suspicious apps

On iPhone:

1. Go to Settings, then General, then VPN & Device Management. Delete any configuration profiles you didn't install.
2. Go to Settings, then General, then iPhone Storage. Review all apps — delete anything unfamiliar.
3. Check Settings, then Privacy & Security, and review which apps have access to Location, Microphone, Camera, and Contacts. Revoke anything suspicious.

On Android:

1. Go to Settings, then Security, then Device admin apps. Deactivate anything you didn't authorize.
2. Go to Settings, then Apps. Sort by recently installed. Uninstall anything unfamiliar — if an app won't uninstall, it likely has device admin privileges (go back to step 1 and deactivate first).
3. Check Settings, then Apps, then Special app access. Review "Install unknown apps," "Display over other apps," and "Usage access" — revoke permissions from anything you don't recognize.
4. Run a scan with Google Play Protect (Play Store, then tap your profile, then Play Protect, then Scan).

Step 4: Update everything

Install any pending OS updates. Update all apps. OS updates frequently patch the specific vulnerabilities that malware exploits — once patched, the malware may lose its foothold even without a factory reset. On iOS, go to Settings, then General, then Software Update. On Android, go to Settings, then System, then System update. Then open your app store and update all apps.

Step 5: Factory reset (if the above didn't resolve it)

If suspicious behavior continues after removing apps and updating, a factory reset is the nuclear option that works. Back up your photos and essential data to a computer (not to the cloud from the compromised device, as some malware persists through cloud restore). Then: on iOS, go to Settings, then General, then Transfer or Reset iPhone, then Erase All Content and Settings. On Android, go to Settings, then System, then Reset options, then Erase all data (factory reset). Set up as a new device — do not restore from backup, as the backup may contain the compromised app or configuration profile. Reinstall apps manually from the official store.

Step 6: Contact your carrier (if SIM swap is suspected)

If you suddenly lost cell service and then saw account takeover activity, you may be the victim of a SIM swap. Call your carrier immediately from another phone. Ask them to: confirm whether a SIM swap was processed, lock your account against further SIM changes, add a PIN or passphrase requirement for account changes. The CISA guide on multi-factor authentication recommends app-based authenticators over SMS-based 2FA specifically because of the SIM swap vector.

How phones actually get compromised in 2026

Understanding the real attack vectors matters more than memorizing symptoms. If you know how compromises happen, you can avoid the behaviors that enable them. Here are the vectors that account for the overwhelming majority of real-world mobile compromises in 2026, ranked by frequency.

1. Phishing links (by far the most common)

An SMS, email, WhatsApp message, or social media DM contains a link. You tap it. The link leads to a page that either: (a) looks like a login page for your bank/email/social account and harvests your credentials, (b) prompts you to install an app or configuration profile, or (c) exploits a browser vulnerability to install something without explicit permission (rare but real — these are zero-day exploits and they're expensive, so they're typically reserved for targeted attacks on journalists, activists, and executives, not random consumers).

In 2026, AI-generated phishing messages are significantly harder to spot than they were even two years ago. The spelling mistakes and awkward grammar that used to be reliable tells are gone. Modern phishing messages are contextually relevant — they reference a real package you're expecting, a real bank you use, or a real event happening in your area. Casper's AI threat detection evaluates links at the DNS and network layer before they reach your browser, blocking known phishing infrastructure and using ML models to flag zero-day phishing domains that haven't hit blocklists yet.

2. Malicious apps (mainly an Android problem)

Apps that look legitimate but contain malware. On Android, this happens through: sideloaded APKs from outside the Play Store (the biggest risk), apps in the Play Store that passed review and later pushed malicious updates, and apps in third-party stores. Google Play Protect catches a lot, but its detection lags behind new malware by hours to days — the window is real. On iOS, the risk is much lower because sideloading requires explicit action (AltStore, jailbreak, or the new EU DMA sideloading pathway), and App Store review, while imperfect, catches most malware before it ships.

The types of malicious apps that succeed in 2026: flashlight/calculator/QR-scanner "utility" apps that request excessive permissions, trojanized versions of legitimate apps distributed outside official stores, and apps that are clean at install but download malicious payloads after review. The common thread is that they need permissions to do damage — a malicious app with no permissions granted can't access your contacts, camera, or messages.

3. SIM swap attacks

An attacker convinces your mobile carrier to transfer your phone number to a SIM card they control. Once they have your number, they receive your SMS-based 2FA codes and can reset passwords on your accounts. This attack doesn't compromise your physical phone — it compromises your phone number, which is arguably worse because so many services use SMS for authentication.

SIM swaps happen through social engineering (calling the carrier and impersonating you), through bribed or compromised carrier employees (documented in multiple FBI cases), or through exploiting carrier account security that relies on easily-obtainable information (last four of SSN, billing address, account PIN that the customer set to "1234"). The defense: set a strong, unique PIN on your carrier account, use app-based 2FA (not SMS) wherever possible, and consider a carrier that supports SIM lock features.

4. Public WiFi and network-level attacks

Connecting to a malicious WiFi network — typically an evil twin that mimics a network your phone trusts — allows the attacker to observe your DNS queries, attempt captive-portal phishing, and perform traffic analysis. The "they can see your passwords" fear is mostly outdated (HTTPS prevents that), but metadata exposure, DNS snooping, and captive-portal credential harvesting are real in 2026. We covered this in depth in our public WiFi attacks guide.

5. Stalkerware (installed by someone with physical access)

A domestic abuser, controlling partner, or suspicious employer installs monitoring software directly onto your phone while they have physical access. This is a distinct category because the attack vector is trust, not technology — the person knows your passcode or can access your unlocked phone. Stalkerware can record calls, read messages, track location, and activate the camera/microphone. On Android, it typically requires enabling "Install from unknown sources" and granting device admin privileges. On iOS, it historically required jailbreaking, though configuration-profile-based stalkerware exists that doesn't.

If you suspect stalkerware installed by someone in your life, the FTC's resources on stalking and surveillance include guidance that accounts for safety planning — simply removing the software can alert the abuser that you've discovered it, which may escalate the situation.

How to prevent your phone from being hacked

Prevention is substantially easier than remediation. These practices address the actual attack vectors above, not hypothetical ones.

Keep your OS and apps updated

This is the single highest-impact security practice. The majority of exploits used in mobile malware target vulnerabilities that have already been patched — the malware works because the target hasn't installed the update. Enable automatic updates. On iOS: Settings, then General, then Software Update, then Automatic Updates — turn on everything. On Android: Settings, then System, then System update, then check for update regularly, and enable auto-update in Play Store settings.

Don't tap links in unexpected messages

The phishing link is the number-one entry point. If you receive a message about a package, a bank alert, or an account issue — and you weren't expecting it — don't tap the link. Instead, open the app or website directly (type the URL yourself or use a bookmark) and check there. This single behavior change blocks the majority of phishing attacks because the attacker needs you to visit their domain, not the legitimate one.

Use app-based 2FA, not SMS

SMS-based two-factor authentication is vulnerable to SIM swap attacks. Switch to an authenticator app (Google Authenticator, Authy, 1Password, or your OS's built-in authenticator) for every account that supports it. Hardware security keys (YubiKey, Google Titan) are even stronger but less convenient. The NIST Digital Identity Guidelines (SP 800-63B) formally discourage SMS-based authentication due to the SIM swap and SS7 interception risks.

Review app permissions regularly

Every few months, review which apps have access to your location, microphone, camera, contacts, and photos. On iOS: Settings, then Privacy & Security — tap each category. On Android: Settings, then Privacy, then Permission manager. Revoke anything that doesn't make sense. A flashlight app doesn't need your contacts. A calculator doesn't need your location. Restricting permissions limits the damage a compromised or malicious app can do.

Only install apps from official stores

On iOS, this is the default (and sideloading requires deliberate effort). On Android, keep "Install from unknown sources" disabled for all apps (Settings, then Apps, then Special app access, then Install unknown apps — everything should say "Not allowed"). The Play Store isn't perfect, but it runs Play Protect scans and has a review process. Third-party APK sites have neither.

Use network-level protection

This is where Casper's Cloak fits into the prevention stack — and we'll be specific about what it does and doesn't do. Casper operates at the network layer: a WireGuard VPN tunnel encrypts your traffic so hostile networks can't observe or inject anything; DNS-level filtering blocks connections to known malicious domains (phishing infrastructure, malware command-and-control servers, ad trackers that build the profiles enabling targeted social engineering); and AI-based threat detection evaluates new domains against ML models trained on phishing patterns, catching zero-day threats that haven't reached static blocklists yet.

What Casper does not do: it doesn't scan files on your device, it doesn't monitor your installed apps, it doesn't detect stalkerware, and it can't prevent you from typing your password into a phishing page you've already loaded. It's a network-layer defense — it blocks the connection to malicious infrastructure before the threat reaches your device. For threats that don't involve a network connection (physical-access stalkerware, social engineering over a phone call), you need other defenses. Tracker blocking specifically addresses the ad-network data collection that feeds the targeted profiling many people mistake for being "hacked."

Use a strong, unique device passcode

A 6-digit numeric passcode is the minimum. An alphanumeric passcode is better. Avoid: 000000, 123456, your birthday, your phone number. Enable biometric unlock (Face ID, Touch ID, fingerprint) so the strong passcode doesn't slow you down day-to-day but is required for sensitive operations. On iOS, consider enabling Stolen Device Protection (Settings, then Face ID & Passcode, then Stolen Device Protection) — this adds time delays and biometric requirements for sensitive changes when you're away from familiar locations.

Bottom line

Most "is my phone hacked?" fears resolve into ordinary behavior once you check the diagnostic table. The genuine indicators — account takeover signals, apps with unexplained elevated permissions, data exfiltration patterns, unauthorized financial activity — are specific and verifiable. If you see those, follow the step-by-step response: disconnect, change passwords from another device, remove suspicious apps, update everything, and factory reset if needed.

Prevention is more tractable than detection. The practices that actually matter are: keep your OS updated (patches the exploits malware relies on), don't tap links in unexpected messages (blocks the primary entry point), use app-based 2FA (defeats SIM swap attacks), review app permissions (limits blast radius), and use network-level protection to block connections to malicious infrastructure before they reach your device.

The honest framing: no single product makes you unhackable. Security is layers. The OS provides one layer (sandboxing, permission model, automatic updates). Your behavior provides another (not tapping phishing links, using strong passwords, reviewing permissions). Network-level tools like Casper provide a third (blocking known-malicious domains, encrypting traffic on hostile networks, flagging zero-day threats). Stack the layers and the probability of a successful compromise drops dramatically.