| What you notice | What it can mean | Planning use |
|---|---|---|
| Battery drain, overheating or data spikes | Not proof of tracking, especially on its own | Record the symptom, then look for other warning signs before drawing a conclusion |
| A green or blue icon on Android, or an orange (microphone) or green (camera) dot on iPhone | An app is using the location, microphone or camera | Work out which app is responsible, and treat the indicator as a lead when you were not using any of them |
| An app that looks harmless, such as a weather app | Malicious apps are often made to look harmless | Judge an app by its permissions and behaviour, not by its name or icon |
| Several signs at once | No sign alone, or even in combination, confirms that a phone has been tapped | Use a cluster of signs as a reason to run the checks below, not as a verdict |
The indicators and cautions in this table come from Avast’s guidance on preventing phone tracking and Norton’s guide to spotting tracked or monitored phones.
How do I know if someone is tracking my phone? Look for a pattern rather than a single symptom: unfamiliar apps, unexpected sensor indicators, unknown logged-in devices and odd permissions together point to tracking, while battery drain alone proves nothing.
If you want the wider picture beyond your handset, our guide on how to stop online tracking covers everyday privacy habits. The rest of this article deals with the phone in your hand: what the signs mean, where to look and what to do when you find something.
Signs that deserve a closer look
The table above covers the most common symptoms. A few more clues are worth adding to your list, and each one is only useful when it fits a wider pattern.
- Frequent unexpected reboots. Surfshark lists repeated, unprompted restarts as a possible sign that a phone has been hacked. Note when they happen and whether they coincide with a new app or a recent link you opened.
- Permissions that do not match the app. Kaspersky points out that a newly downloaded game has no good reason to need microphone access. Any app asking for access that its job does not require deserves a second look.
- Performance problems that arrive slowly. Surfshark notes that spyware can take weeks or even months before noticeable changes appear, so a phone that feels fine today is not a clean bill of health.
Because no single sign is conclusive, the practical approach is to collect evidence. Work through the account and app checks below and treat each unexplained finding as something to resolve rather than ignore.
Tracking that needs no spyware
A phone can be tracked without any hidden app. Bitdefender explains that phones can be tracked through shared accounts, location services, or devices that remain logged into your Google or Apple account. The consequence is that a clean app list does not settle the question, and the account side needs checking too.
- Location sharing. Check Google Maps, Apple Find My and any family tracking apps for people or devices that can see where you are. Stop sharing with anyone who should not have it.
- Google accounts. Open Google Account > Security > Your Devices and look for a phone, tablet or computer you do not recognise.
- Apple accounts. Open Settings > Apple ID > Devices and review the list the same way.
Bitdefender’s advice is to remove any device you do not recognise from your account settings. Do that before moving on to app checks, because a logged-in device can keep reporting your location after you have cleaned up the handset.
How spyware and stalkerware reach a phone
Spyware, including the stalkerware used to monitor a specific person, usually arrives as a malicious or hidden app that the owner never knowingly installed, according to Norton. That is why manual review of the installed app list matters more than watching the home screen.
Platform differences shape how you search. Kaspersky reports that Android devices are more frequently targeted by stalkerware than iPhones, though iPhones are not immune. Android owners should pay particular attention to the device administrator list described below, since a monitoring app can register itself there to resist removal.
Settings to check on Android and iPhone
The paths below give you a repeatable audit. Menu names can vary slightly between manufacturers and software versions, so use the search bar in Settings if a label differs.
Android
- Privacy Dashboard. On supported Android versions, go to Settings > Privacy > Privacy Dashboard. Kaspersky says it shows a timeline of which apps accessed sensors and when, which lets you spot a microphone or location request you cannot explain.
- Device administrator apps. Go to Settings > Security > Device Admin Apps and look for anything you did not set up.
- Data usage. Go to Settings > Network and internet > App data usage, as Surfshark describes, and look for an app using far more than its purpose justifies.
iPhone
- Mobile data. Go to Settings > Mobile Data and review the list by consumption, as Kaspersky suggests. An unfamiliar or oddly heavy app is worth investigating.
- Battery. Both Android and iPhone let you check battery life data through the Settings app, per Norton. Use it to see which app is responsible for drain rather than guessing.
Call forwarding
Kaspersky describes dialler codes for checking whether calls are being redirected. A check code from your phone’s dialler shows whether unconditional call forwarding is enabled on supported networks, and a cancel code ends any active forwarding.
What to do if you find tracking
Order matters more than speed. Follow this sequence so that one step does not undo another.
- Change passwords from a different device. Kaspersky advises using another device to change your passwords before touching anything on the phone.
- Remove unknown logged-in devices and stop location sharing. Use the account lists and sharing apps covered earlier.
- Revoke administrator rights, then uninstall. If an app has registered itself as a device administrator, Kaspersky says you need to revoke that privilege first. Then uninstall it from Settings > Apps.
- Reset only as a last resort. A factory reset is for the case where removal fails or the phone still behaves oddly.
The safety question matters as much as the technical one. If you think the person monitoring you may react badly when they lose access, consider speaking to a local support service or the police before you remove anything, and take screenshots of what you found.
Once the phone is clean, tidy what stays behind on it. Browsing records are a separate matter, and our walkthrough on how to clear browsing history covers the main browsers. To understand what protection a VPN adds to your connection, read Why Use A VPN? How It Protects Your Privacy, Security, And Access In 2026 – Cubeguard.
Frequently asked questions
Is an iPhone safer from stalkerware than an Android phone?
Android devices are more frequently targeted by stalkerware, according to Kaspersky, but iPhones are not immune. Account-based tracking works on either platform, so the account checks apply to both.
Will a security app find everything on an iPhone?
Not necessarily. Kaspersky notes that third-party security apps have more limited access to system processes on iPhone, so manual checks of apps, permissions, data use and logged-in devices carry more weight there.
How can I tell whether the problem is the phone or the SIM card?
Norton suggests testing a different phone with the same SIM card. If the symptoms stay with the SIM rather than the original handset, a hardware fault on the first phone is less likely to be the cause.
How long can spyware go unnoticed?
It can take weeks or even months for noticeable changes to emerge, according to Surfshark. A phone that seems normal is therefore not proof that nothing is installed, which is why the periodic account and permission checks are worth repeating.
