How to Tell If Your Android Phone Is Hacked (2026 Guide)

Written by AbsarDrayz

A tech writer with 9+ years of experience in AI tools, software reviews, and digital technology. He enjoys breaking down complex topics into simple, easy-to-understand guides so even beginners can follow along. His focus is on honest, practical, and SEO-friendly content that actually helps readers choose the right tools with confidence.

Published July 9, 2026 · 12 min read · Checklist tested on Pixel, Samsung, and OnePlus devices

A friend of mine — I'll call her M., because she'd kill me if I used her real name in an article — messaged me at 1 a.m. a few months back with a screenshot of her battery settings and the words "ok I think I'm being watched, don't laugh." She wasn't being dramatic. Her ex had had access to her phone for about a week during a messy breakup, and now her battery was dying by 2 p.m. every day and her data usage had tripled. We spent the next forty minutes on the phone going through exactly what's in this article, step by step, at 1 in the morning, because that's apparently when phone paranoia peaks.

That conversation is basically the reason this guide exists in its current form. I'd written versions of "is your phone hacked" content before, the generic kind every tech site has, but going through the real thing with someone who was genuinely scared taught me which steps actually matter and which ones are just filler. M., for the record, turned out fine — it was a poorly coded fitness app eating her battery, not her ex. But the check we ran to confirm that is the same one I'm about to walk you through.

Somebody messages me some version of "is my phone hacked?" at least once a month now. Usually it's a battery graph. Sometimes it's a weird pop-up. Nine times out of ten, it's nothing — but every so often it isn't, and from the outside, the panic looks identical either way. That's the annoying part.

Quick answer, if you're in a hurry

• Most "hacked phone" symptoms — slow performance, warm phone, one weird ad — are false alarms caused by normal wear or a bad app, not spyware.
• The strongest real signals are an app you don't remember installing, unexplained data spikes, or texts/calls sent from your number that you didn't send.
• Run Google Play Protect first, then manually check Accessibility and Device Admin permissions — that second step catches what Play Protect often misses.
• If you find something, disconnect from the internet, remove the app, and change your Google password from a different device.

Quick note before we get into it — I'm not a security researcher, and I want to be upfront about that. What I am is someone who's spent close to a decade testing software and troubleshooting devices for a living, and who's fielded this exact panic from readers and friends more times than I can count. If what you're dealing with involves a genuinely dangerous person in your life — not just "is my phone acting weird" but "I think someone specific is tracking me" — jump down to the stalkerware section near the bottom. That's a different situation than a garden-variety malware scare, and I say that having had that exact conversation more than once.

The signs that actually mean something

Let's start with the battery, since it's the one I hear about constantly and, honestly, also the one that's wrong most of the time. A battery draining way faster than it used to almost always

turns out to be one app somebody forgot was running, or a brightness setting that crept up without anyone noticing. I've personally chased this exact complaint down to a rogue weather widget more than once, and in M.'s case, it was a fitness tracker syncing every ninety seconds for no reason. But if your battery health hasn't changed and the drain got noticeably worse overnight with nothing new installed, that pattern is worth digging into. Spyware runs background processes constantly, and eventually that shows up as drain. It just does.

Then there's data usage. Malicious apps like to phone home in the background even when you're not touching the phone, so a spike you can't explain is worth a look. Settings, then

Network & Internet, then Data usage. Check for anything eating way more than it has any business using — and pay attention to the time of day it's active. Spyware that only uploads data at 3 a.m., while you're asleep and the phone is idle, is a specific pattern worth screenshotting if you plan to escalate this to anyone later.

An app you don't remember installing? That's a stronger one, especially if you can tie it to a specific moment. You clicked something you probably shouldn't have. You handed your
unlocked phone to someone for "just a second." A reader once told me about a "system update" app that showed up right after she downloaded an APK from a text link. Classic sideloading trick, and depressingly effective, because who second-guesses a text that says "system update"?

Ads showing up outside of any app or browser, just while you're sitting on your home screen

— that's usually adware. I dealt with this on my own phone a couple of years back after sideloading a sketchy PDF reader out of laziness. Annoying, mostly harmless, but it still needs to go.

A phone running hot or sluggish for no obvious reason doesn't prove much by itself.

Background processes like ad fraud, data exfiltration, or cryptomining can all cause it, sure, but so can a dozen boring things that have nothing to do with hacking. It's really the combination with other signs that starts to matter.

If people are getting texts or calls from you that you never sent, I'd take that one more

seriously than most. Usually it means a compromised messaging app. In rarer cases it points to a SIM swap, which is a whole separate headache I won't get into here.

And then there's your Google Account showing sign-ins from devices you don't recognize. Technically that's more "account" than "phone," but the two get tangled up in people's heads constantly, and checking takes maybe ninety seconds. Google's Security Checkup shows recent device activity and lets you kick out anything unfamiliar. If you're on an iPhone as well and juggling both ecosystems, it's worth knowing Apple's side works differently — Siri and iOS handle app permissions in their own way, and the iOS 27 Siri feature changes actually touch on some of the same permission concerns from the Apple side, if that's relevant to your setup.

What's probably not a hack

This part matters just as much as the last one, honestly, because false alarms cause just as much stress as real problems do. I've watched people talk themselves into a full-blown panic over things that turned out to be completely normal — and I'll admit I've done it to myself once or twice, too.

A phone that's gotten slower gradually over months? That's aging hardware and app bloat, not a hack — every phone does this eventually. One random pop-up on a website you already had open is almost always an aggressive ad network on that specific site, nothing to do with your device at all. Your phone getting warm during a long call, a gaming session, or while it's charging is just normal thermal behavior. And seeing "Unknown" once in your call log is probably a spam call, not evidence of anything.

The single most common message I get isn't "my phone was hacked." It's "I panicked and factory reset my phone, and now I've lost photos I never backed up." That's a worse outcome than most actual malware infections.

If that's already happened to you, don't panic further — there are legitimate recovery paths depending on how recently you reset and whether Google Photos backup was on. I put together a separate, detailed walkthrough on how to recover deleted photos on Android that covers this exact scenario, including what your actual odds are depending on how much time has passed.

Step 1: Run a Google Play Protect scan

This is always where I start. It's fast, it's already sitting on your phone, and there's genuinely no reason not to run it first.

Why it works: Play Protect scans everything installed on your device — including stuff you sideloaded outside the Play Store — and checks it against Google's list of known malicious apps. Google's own Play Protect documentation lays out exactly what it looks for, if you want to go deeper on this.

To run it: open the Play Store, tap your profile icon, tap Play Protect, then tap Scan. That's genuinely it.

Where it actually falls short: Play Protect is good — genuinely good — at catching known malware families. It's a lot less reliable against something brand-new or purpose-built, especially apps sold specifically to monitor a partner's or family member's phone. That category, usually called stalkerware, is sometimes built specifically to slip past scanners like this one. A clean scan is reassuring. It's not proof of anything, and I don't want to oversell it to you.

Step 2: Go through your app list by hand

Settings, then Apps, then See all apps. Actually scroll through the whole thing — not just what's sitting on your home screen, because that's exactly where something suspicious would hide. What you're looking for:

• Vague, official-sounding names like "System Service" or "Update Manager" that don't ring a bell
• Apps asking for permissions way beyond what they'd plausibly need — a flashlight app wanting your contacts and messages, say
• Anything that showed up around the same time you clicked something sketchy or lent your phone out

I won't pretend this one's quick. It takes real time and attention. Some spyware is built to hide well — generic icon, missing from your app drawer entirely, but still technically listed in the full Settings menu if you go looking for it. If a name doesn't ring a bell, search its exact package name instead of the display name. That tends to surface what it actually is a lot faster than guessing.

Small trick that saves time: sort your app list by "Recently installed" if your phone's Settings menu offers it. It puts anything new right at the top instead of making you scroll past 200 apps alphabetically.

Step 3: Check accessibility and device admin permissions

This is the step almost everyone skips, and it's honestly the one that tells you the most, in my experience.

A lot of real spyware and stalkerware leans on Accessibility or Device Admin permissions, because those two hand an app deep, nearly unrestricted visibility into everything happening on your phone. Normally those permissions exist for legitimate accessibility tools, or for devices a company manages remotely. Not for some random app you don't remember installing.

Go to Settings, then Accessibility. Separately, check Settings, then Security, then Device admin apps (the exact path shifts a bit depending on who made your phone — Samsung buries this differently than a Pixel does, and I've had to walk readers through both, plus a OnePlus once that hid it under a menu called "Special app access" for no reason I've ever understood). Anything in there you don't recognize, or don't remember approving, is a genuine red flag. Don't talk yourself out of it just because it's inconvenient.

Step 4: Check your Google Account activity

A huge number of "my phone got hacked" situations turn out to actually be "my account got hacked" situations. So do this regardless of what you found, or didn't find, on the device itself.

Head to myaccount.google.com and look over recent security activity and sign-in locations, devices currently signed in, and any third-party apps with account access. Google walks you through updating your password, reviewing connected apps, and turning on two-factor authentication if it isn't already on — all worth doing even if nothing looks alarming.

One catch, though: this tells you a lot about your account but not everything about the device itself. A phone can get compromised through a malicious local app without that ever touching your account activity, and vice versa. Related problems. Not the same problem.

If you actually find something

Say you've turned up an app you don't recognize, unexplained device admin access, or a real pattern from the list above. Here's roughly the order I'd move in, and yes, the order matters:

1. Disconnect from Wi-Fi and mobile data first if you suspect something's actively sending data out — just to stop the bleeding while you sort through the rest.
2. Uninstall the suspicious app through Settings, then Apps. If it won't uninstall, check Device Admin apps first and revoke its access there. Plenty of spyware specifically blocks uninstallation until you do that.
3. Change your Google Account password right away, and do it from a different, trusted device, not the phone you suspect is compromised.
4. Turn on two-factor authentication if you haven't already.
5. Go back through your Google Account and revoke access for anything unfamiliar.
6. If nothing short of a clean slate is going to make you feel okay again, back up what matters first and then do a full factory reset. It's genuinely the most reliable way to clear out anything you couldn't identify by hand — just make sure your photos and files are actually backed up before you do it, since a reset without a backup is its own kind of disaster.

Mistakes I see people make

The biggest one is panicking and factory resetting before checking anything at all. I get the instinct — you just want it gone — but run through Play Protect, your app list, and your accessibility and device admin permissions first. A reset also wipes out evidence you might genuinely need later, especially if this turns out to involve someone you know, where documentation actually matters down the line. And as I mentioned above, it's also how people accidentally lose years of photos in about ninety seconds.

Right behind that: downloading some random "antivirus" app to fix it. A lot of the most-downloaded "cleaner" and "antivirus" apps out there are themselves low-value, ad-heavy, or asking for permissions they have no real reason to want — I've uninstalled more of these off friends' phones than I can count. Start with Play Protect, and if you want a second opinion, go with an established security vendor rather than whatever happens to rank first in a search.

Don't change your password on the same device you think is compromised, either. If there's genuinely a keylogger-style tool sitting on that phone, typing your new password there just hands it straight to whoever's watching. Do it from somewhere else.

And don't assume a clean Play Protect scan means you're fully in the clear — follow it up with the manual accessibility and device admin check, since some monitoring tools are built specifically to dodge automated scans.

A lot of people also ignore it because "nothing's been stolen yet." Data theft and monitoring are often invisible right up until they're used against you, sometimes weeks later. Take the early signs seriously even when nothing bad has visibly happened.

A note on safety: The mistake I care most about is people staying quiet just because they suspect it was someone they know. If you believe a partner, family member, or anyone else installed monitoring software on your phone without your consent, that's a safety issue first and a tech problem second. Groups like the National Domestic Violence Hotline and the Coalition Against Stalkerware have specific guidance for this, including how to remove the software without tipping off the person who installed it before you're ready — which can genuinely matter for your safety.

Keeping it from happening again👍

• Leave Play Protect turned on — it's on by default and there's rarely a good reason to disable it.
• Skip sideloading APKs from links in texts, emails, or random websites.
• Check your app permissions every so often, especially anything touching Accessibility, Device Admin, or SMS.
• Use a screen lock and don't share your unlock code, even with people you trust, since physical access is one of the easiest ways this stuff gets installed in the first place.
• Keep Android updated, since security patches close the exact holes this kind of thing exploits.
• Turn on two-factor authentication on your Google Account, so a stolen password alone isn't enough to get someone in.
• Turn on automatic photo and file backup now, before you ever need it — it's the single thing that would have saved most of the "I reset and lost everything" messages I get.

FAQ

How can I tell if my Android phone has a virus?

Mainly by looking for apps you don't remember installing, data usage that doesn't add up, pop-ups outside of your apps or browser, and battery drain that got noticeably worse with nothing new installed or changed.

Does a factory reset remove spyware or hacking software?

Pretty much always, yes. It wipes the OS and every installed app, which takes the vast majority of malware and spyware down with it. The rare exception is a firmware-level compromise, but that's uncommon for a typical consumer situation.

Can someone hack my phone just by texting me?

Not really, no — just receiving a text isn't going to compromise anything on its own. The risk is in clicking a link or downloading an attachment inside that text.

Is #21# or codes like it a real way to check for hacking?

Nope. Those carrier codes float around online as "hacking detection tricks," but they don't reliably catch spyware or monitoring apps, and security researchers have debunked this one more than once. Skip it.

Can Play Protect catch everything?

It can't. It's solid against known malware families, but it's not guaranteed to catch something custom-built or brand new — especially consumer-grade stalkerware that's specifically designed to slip past it.

What's the difference between my phone being hacked and my Google Account being hacked?

A hacked phone usually means there's a malicious app or unauthorized access sitting on the device itself. A hacked account means someone has your password or session access, and that can happen with zero malware on your phone at all — a phishing site, or a password you reused somewhere else that got breached.

Should I change my password before or after removing suspicious apps?

Remove the app first if you can, then change your password — and do it from a separate, trusted device, not the one you think is compromised.

Which permissions should worry me most on an app?

Accessibility Service and Device Admin access, by far. Those two give an app a level of visibility and control that goes well beyond what most legitimate apps actually need.

Can I tell if someone installed stalkerware on my phone?

Sometimes, yeah. Check your app list carefully and specifically review Accessibility and Device Admin permissions, since most stalkerware leans on one of the two. If you suspect this involves someone with access to your life or your safety, treat it as more than a tech problem — a domestic violence support organization can walk you through this more carefully than I can.

Does my phone getting warm mean it's hacked?

Not on its own. Warmth from charging, gaming, or a long call is completely normal. It only becomes worth worrying about when it shows up alongside other signs, like a data usage spike or an app you don't recognize.

Is it normal for battery to drain faster right after an Android update?

Yes, that's pretty common for a few days after a major OS update while everything re-indexes and apps re-optimize in the background. Give it some time before you assume it's a security problem.

Related reads from our blog👇

• How to Recover Deleted Photos on Android — if you've already reset your phone and lost things you needed
• iOS 27: All the New Siri Features — worth a look if you're comparing how Apple handles permissions and privacy on the other side
• More troubleshooting guides on our site

About the Author

Absardrayz is a tech writer with 9+ years of experience in AI tools, software reviews, and digital technology. He enjoys breaking down complex topics into simple, easy-to-understand guides so even beginners can follow along. His focus is on honest, practical, and SEO-friendly content that actually helps readers choose the right tools with confidence