Is my phone hacked? How to check and what to do

Many "hacked phone" worries turn out to be a hacked account, a dodgy app or an ageing battery. Here is how to tell which, and what to do.

Written by: Digital Life Check editorial team
Reviewed by: Not yet independently reviewed
Last checked: 22 September 2026

Do this now: change the password for your email account from a device you trust, then check your email, Apple or Google account for logins you don't recognise. If money has left your bank, call your bank on 159 or the number on the back of your card.

Often, when something feels wrong, the problem is not the phone itself. It is an online account someone has got into (email, WhatsApp, social media, Apple or Google) or an app that shouldn't be there. Both can be fixed.

Signs worth acting on

These come from the National Cyber Security Centre (NCSC), Google and Apple.

You can't log in to an account, or your password suddenly stops working.
Security settings have changed and you didn't change them.
Friends get messages or emails from you that you didn't send.
Your account shows logins from strange places or at odd times.
Money has moved, or there are purchases you don't recognise.
You get a two-factor code you didn't ask for.
Pop-ups or ads that won't go away, or your browser's homepage or search engine changes by itself.
Apps you don't remember installing.
Your phone was locked or put in Lost Mode by someone other than you.

Things that are usually not hacking

Battery draining faster. All rechargeable batteries wear out. Apple says a battery holds less charge as it chemically ages, which means fewer hours between charges. On iPhone, check Settings > Battery > Battery Health (called Battery Health & Charging on some versions).
Slowness on its own. Google does list a very slow device as a possible sign of malware, so don't ignore it — but check your storage and install any updates first, then work through the steps below if it carries on.
One strange text or call. Getting a scam message doesn't mean your phone is hacked — only acting on it can cause harm. See how to tell if a text is a scam.
A caller saying your device is infected. The NCSC says this is a common scam, often claiming to be from Microsoft or your internet provider. Hang up.

Step 1: Secure your accounts (do this first)

Change your email password from a device you trust. Your email is the key to resetting everything else.
Check email forwarding rules and filters. The NCSC says a common tactic is to set up forwarding so they get copies of your email, including password resets. Your email provider's help pages show where to find these.
Change passwords on any hacked account, and anywhere you used the same password.
Log out all other devices. Most services let you do this in their security or account settings.
Turn on two-step verification (2SV). See what two-factor authentication is.

If you can't get back in, go to the provider's official help pages and follow its account recovery process.

Step 2: Check your iPhone

Update iOS: Settings > General > Software Update.
Check your Apple Account devices: sign in at account.apple.com, select Devices, and remove any you don't recognise.
Check for profiles you didn't add: Settings > General > VPN & Device Management. If you see a profile you don't recognise and the phone isn't from work or school, tap it and choose Delete Profile, then restart.
Remove apps you don't recognise.
Use Safety Check (iOS 16 or later): Settings > Privacy & Security > Safety Check. It lets you review who and what has access to your information, see devices signed in to your Apple Account, reset app permissions and change your passcode and Apple Account password.

If you think your Apple Account itself is compromised, Apple also advises checking with your mobile network that no one has set up SMS forwarding on your number.

Apple's Lockdown Mode is an extreme protection for the very few people who might be personally targeted by sophisticated spyware — Apple says most people will never be targeted this way. It limits many normal features, so it isn't a general fix.

Step 3: Check your Android phone

Run Google Play Protect: open the Google Play Store, tap your profile icon, then Play Protect. In its settings, make sure Scan apps with Play Protect is on, then run a scan.
Update Android: Settings > System > Software updates. For security updates, Google's help pages point to Settings > Security & privacy > System & updates. Menu names vary by make.
Remove apps you don't trust, don't need, or didn't get from the Google Play Store.
Run Google's Security Checkup at myaccount.google.com/security-checkup and fix anything it flags.

The NCSC notes that some apps check whether a phone has been "rooted" (Android) or "jailbroken" (iPhone). If you get that warning and haven't done it yourself, treat it as a sign something is wrong.

Step 4: If it's still not right

The NCSC says phones and tablets usually can't be cleaned by antivirus in the way computers can, and the safest fix is a factory reset (in Settings — the exact name depends on your phone). Back up your photos and contacts first, and restore only from a backup made before the problems began. If a reset doesn't fix it, get expert help — for example from your phone's maker or the shop you bought it from.

Get help and report it

Money taken or accounts hacked: call your bank on 159 or the number on your card, then report to Report Fraud (which replaced Action Fraud) at reportfraud.police.uk (opens in a new tab) or 0300 123 2040. In Scotland, call Police Scotland on 101.
You think someone you know has access to your phone: Apple's Safety Check is designed for this situation, including an Emergency Reset that stops all sharing at once.

Keep it from happening again

Turn on automatic updates.
Use a different password for each important account — test yours with our on-device Password Check.
Only install apps from the official app store.
Take our Security Check for a quick run-through of your settings.

Sources

Last checked: 22 September 2026