If you are wondering how do you know if your phone is hacked, start with evidence rather than panic. A warm phone, a dropped call, or a slow app does not automatically mean someone has taken control. Phones age, batteries wear out, and poorly designed apps can behave badly. The useful question is whether several unusual signs appear together, especially changes involving your accounts, messages, settings, or cellular service.
Signs that deserve a closer look
Battery drain is one clue, but it is not proof. Check Settings on an iPhone or Android phone to see which apps have used the most battery over the last 24 hours or several days. An unfamiliar app using significant power, mobile data, or background activity deserves attention. The same applies to a phone that becomes hot while sitting idle, although a software update, weak cellular signal, navigation app, or video call can create the same effect.
Other warning signs are more serious. You might see text messages marked as read when you never opened them, password-reset emails you did not request, or calls and messages sent from your number. Pop-up ads appearing outside your browser, a new device listed in your Apple or Google account, or settings that change without your action are also worth investigating. A sudden loss of cellular service can indicate a SIM-swap attempt, particularly if your carrier says the number was transferred to another SIM.
Do not treat every strange symptom as surveillance. A cracked screen, aging battery, aggressive advertising, and a bad charger explain many everyday problems. Look for a pattern that affects privacy or account access, not just performance.
How do you know if your phone is hacked through account activity?
In many real incidents, the attacker does not need to control the entire phone. Stealing a password, accessing an email account, or taking over a phone number can be enough to reach photos, messages, shopping accounts, and financial services. That is why account activity is often more reliable than battery behavior.
Open your Apple Account, Google Account, Microsoft account, and primary email security pages from a device you trust. Review recent sign-ins, connected devices, recovery phone numbers, forwarding rules, and third-party apps with access. Look for a location, browser, or device you do not recognize. Location data is not perfect because mobile networks and VPNs can misidentify a region, but an unfamiliar device model or sign-in time is a stronger warning.
Check your bank, credit card, social media, and shopping accounts as well. Search email for phrases such as “password changed,” “new sign-in,” or “two-factor authentication.” If your email account has been compromised, an attacker may create a forwarding rule so security messages disappear from your inbox. Remove that rule and change the email password before changing less important passwords.
If you are still asking how do you know if your phone is hacked, account records can provide a clearer answer than a phone diagnostic app. Avoid apps that promise to reveal a hacker instantly. Many are scareware, paid junk, or tools that request more permissions than they need.
Check the phone safely without making the problem worse
Use a trusted computer or another phone to change the password for your main email account first. Choose a long, unique password that you have not used elsewhere. Then change your Apple Account or Google Account password, followed by banking, payment, social media, and shopping accounts. Sign out unfamiliar sessions and remove unknown devices.
Turn on multifactor authentication using an authenticator app or security key when available. Text-message codes are better than no second factor, but they are less resistant to SIM-swap attacks. Ask your cellular provider to add an account PIN or port-out protection. Never share a one-time code with someone who calls claiming to be from Apple, Google, your bank, or your carrier.
On the phone itself, install pending operating system updates from the normal Settings app. Delete unfamiliar apps, browser extensions, configuration profiles, and VPNs. On iPhone, inspect Settings, General, VPN & Device Management. On Android, review installed apps, accessibility services, device administrator apps, and the permission manager. An unknown app with accessibility or administrator access deserves immediate attention.
Do not root or jailbreak the device while troubleshooting. Do not install random “security” software from a pop-up. Those actions can weaken built-in protections and make it harder to understand what happened.
What to do if your number or money is at risk
A phone account takeover needs a fast response. If your phone suddenly shows “No Service,” contact the carrier from another phone and ask whether the number was moved, a replacement SIM was issued, or account details changed. Add or reset the carrier PIN. If you still have service but receive unexpected SIM or eSIM notifications, contact the carrier anyway.
For suspicious banking activity, call the number on the back of your card or the financial institution’s official website, not a number supplied in a text message. Ask the bank to review recent transactions, lock a card if necessary, and explain the next steps. Change the banking password from a trusted device and consider temporarily removing stored payment cards from shopping accounts.
Save evidence before deleting anything. Take screenshots of unfamiliar sign-ins, preserve suspicious emails, and write down dates, times, phone numbers, and account changes. This record can help a bank, carrier, workplace security team, or law enforcement agency understand the sequence of events.
When a factory reset makes sense
A factory reset is useful when you cannot identify unwanted software, the device remains unstable after updates, or a trusted security professional recommends it. Before resetting, confirm that your photos, contacts, authenticator backups, and important files are safely stored. Make sure you know the Apple Account or Google Account password required to activate the phone afterward.
After the reset, set up the device as new rather than restoring every app automatically. Reinstall apps from the official App Store or Google Play, one group at a time, and review permissions as you go. Update the operating system before signing into sensitive accounts. If the phone is owned or managed by an employer, contact workplace IT before wiping it because a reset can remove useful evidence or management settings.
A reset will not repair a compromised email account, stolen password, or hijacked phone number by itself. Secure those accounts first, or the same attacker can regain access.
How do you know if your phone is hacked after you secure it?
Monitor the accounts and device for the next two weeks. Look for repeated password-reset messages, new sign-ins, unexpected verification codes, unusual data usage, or changes to recovery information. Run the phone normally and note whether the original symptoms continue. If the problem disappears after removing one unfamiliar app, that is useful evidence, although it does not prove the app was malicious.
For most households, a simple routine provides better protection than an expensive security subscription: automatic updates, a strong screen lock, unique passwords in a reputable password manager, multifactor authentication, regular backups, and careful permission reviews. Keep Find My iPhone or Find My Device enabled, and know how to remotely lock the phone if it is lost.
The practical answer to how do you know if your phone is hacked is not one dramatic symptom. It is a combination of unexplained account activity, unauthorized changes, suspicious apps, and behavior that remains after ordinary causes are ruled out. Work from your most valuable account outward, use official support channels, and make the technology earn its place by reducing risk rather than adding fear.
