Signs your phone is hacked, and what to do about each one

If you're searching for signs your phone is hacked, start with the one that matters most: are you getting 2FA codes, password reset emails, or "new sign-in" alerts you didn't ask for? That is the clearest sign, and it points at your accounts rather than your handset. A warm phone and a slow afternoon point at nothing.

Most cases fall into three buckets. Someone has your account password and is signing in from their own device. An app you installed has more permissions than it should. Or someone has convinced your mobile operator to move your number to their SIM. A silent remote implant on a fully updated phone exists, but it is expensive, rare, and not what is happening to most people reading this.

So the fix is usually in your accounts and settings, not the hardware. Check those first; keep the factory reset for when the cheaper checks come up empty.

Signs your phone is hacked that actually mean something

Unexpected 2FA codes or reset emails. A code arrives and you weren't signing in. Someone has your password and is stuck at the second factor. Your password is burned, but the account is still yours. Change it now, from a device you trust.

Apps you don't remember installing. On Android this includes apps that hide their icon from the launcher. The list under Settings, then Apps (menus move, but every phone has one) shows everything installed, icon or not. On iPhone, the Storage list does the same.

Email forwarding rules or filters you didn't create. This is the one people miss. An attacker who gets into your email adds a rule that forwards a copy of everything to an address they control, or auto-deletes security alerts so you never see them. They can then stay out of your inbox entirely and still read it. Check filters and forwarding in your mail provider's settings, not just the recent-login list.

Battery or data use with a named cause. Both Android and iOS show usage per app. A spike by itself is noise. A spike from an app you don't recognise is a lead.

Your SIM loses service for no reason. If your phone drops to "No service" or "SOS only" while people around you are fine, and it doesn't come back after a restart, treat it as a possible SIM swap until your operator says otherwise. The attacker now receives your calls and SMS, including the codes banks send.

Call forwarding is switched on. Dialling *#21# on most GSM networks shows whether unconditional forwarding is active; *#62# shows forwarding when unreachable. These codes are operator-dependent, so if they return an error, check forwarding in the Phone app's settings or ask your operator.

Signs that usually mean nothing

The phone is warm. Apps crash occasionally. The battery drains faster than it did two years ago. Pop-up adverts appear in a browser.

None of these is evidence on its own. Warmth is a charging phone or a video call. Crashes are software. Battery degrades with age. Browser pop-ups come from the sites you visit, not from an implant.

They don't justify panic or a wipe. If one coincides with a sign from the list above, it becomes supporting evidence. Alone, it's a Tuesday.

What to do, in order

The order matters because each step closes a door that would otherwise let the attacker back in after the next step. Reset the phone first and you've handed a clean phone to someone who still has your email password.

1. Secure the accounts that matter, from a device you trust. Email first, because it resets everything else. Then banking, then the app store account, then anything with a saved card. Change the password, sign out of all other sessions (most providers have this button), and remove any forwarding rules, recovery addresses or phone numbers you don't recognise. The full ordering is in the first hour of a hacked account; the hacked account triage tool turns it into a checklist.
2. Review app permissions and device admin apps. On Android, look at which apps have Accessibility, Device admin, Notification access, and "Display over other apps". Those four are what a malicious app needs to read your screen, block uninstall, read your codes, and overlay fake login screens. On iPhone, check Settings for configuration profiles or MDM enrolment you didn't set up. Remove what you can't explain.
3. Check call forwarding and SIM status. Use the dial codes above or the Phone app's settings. If service is gone, call your operator from another phone, ask whether a SIM change was requested, and ask for a port-out PIN or account note so it can't happen again without you present.
4. Update the OS and every app. Most phone compromises that aren't account compromises rely on a bug that has already been fixed. Update, then restart. This costs a few minutes and a reboot.
5. Factory reset, as the last resort. Only after steps 1 to 4, and only after backing up photos and documents to a service whose password you've already changed. Don't restore a full device backup afterwards; restore photos, contacts and messages, and reinstall apps fresh. A full backup can carry the problem back with it.

This routine costs about an hour, most of it in step 1. Skipping it costs doing the whole thing twice.

Stalkerware, said carefully

Some of what people call "my phone is hacked" is a partner, ex-partner or family member who has installed a monitoring app. These are sold as parental control or employee tracking tools and are deliberately quiet. On Android they show up as apps with Accessibility and Device admin permissions, often with a bland name. On iPhone, where sideloading is harder, the common route is that the person knows your Apple ID password and reads your backups and location from there.

If this might be you, two things before you touch anything. Removing the app or changing the password tells the person who installed it, and if that could be dangerous, the safer step is to talk to a domestic abuse helpline or someone you trust first, and plan the removal. Second, if you may need evidence later, photograph the app list and permissions before uninstalling.

I'm an engineer, not a counsellor, and that's the limit of what I can usefully say.

Report it, and stop it happening again

In India, report financial loss or a SIM swap at cybercrime.gov.in or by calling 1930, and do it quickly, because the speed of a freeze on the receiving account matters. Readers elsewhere should use their national cybercrime reporting line.

Then close the doors that got opened. Move the accounts that matter to passkeys or an authenticator app rather than SMS codes, so a SIM swap doesn't hand over your bank; passkeys vs passwords vs 2FA explains what each one stops. And go through who still has access to your accounts, because old sessions and connected apps are how most people get re-compromised.

Frequently asked questions

Can someone hack my phone just by calling me? Not on an updated phone in any practical way. The realistic risk from a call is what you say during it: a code, a password, or agreeing to install something. The call is the attack, not the connection.

Will a factory reset remove a hacker? It removes software on the phone. It does nothing about an attacker who has your email password, your SIM, or a forwarding rule in your inbox. That's why the reset is step five and not step one.

I got a 2FA code I didn't request. Am I hacked? Your password for that account is probably known to someone, but the second factor held. Change the password from a trusted device and sign out other sessions. Don't type the code anywhere, and don't give it to anyone who calls asking for it.

How do I know if it's a SIM swap or just bad signal? Bad signal comes back when you move or restart. A SIM swap doesn't, and it usually arrives alongside password reset emails you didn't trigger. If both are happening, phone your operator from another handset now.

If you've got five minutes, open the hacked account triage checklist and do step one for your email account today, whether or not anything looks wrong. It's the step that protects every other one.