| Sign or effect | What it can mean | Planning use |
|---|---|---|
| Apps you did not install | A telltale sign that the phone may be compromised | Open the installed apps list now and note anything you did not add yourself. |
| Quick battery drain despite moderate use | Can be malware running in the background | Treat it as a prompt to review apps, not as proof on its own. |
| 2FA codes you never requested | Someone may be trying to get into one of your accounts | Change that account’s password from a different device. |
| Logged out of your Apple or Google account and unable to log back in | Could indicate that someone else controls the account | Start account recovery from another device and review recent sign-ins. |
| Logins from unfamiliar locations or devices, or unauthorized transactions | Account misuse, whether or not the phone itself is infected | Review activity in each affected account and secure it first. |
| Call forwarding switched on | One symptom, not proof of a hack or a tap | Check its status and turn it off, then keep looking for other signs. |
These signs come from Cape’s phone-hack recovery guide and Norton’s call-forwarding check.
If your question is my phone was hacked how do i fix it, the order matters: secure your accounts from a different device first, then remove suspect apps, and treat a factory reset as the last resort.
Once you have recovered, the habits in how to protect yourself from hackers reduce the chance of a repeat.
What a compromised phone puts at risk
A hacked phone is rarely only a phone problem, because the device holds the keys to your accounts, calls and messages. Knowing where the damage lands tells you where to start.
- Your accounts. Notifications for authentication codes you never requested, password-change alerts and logins from unfamiliar locations all point at accounts rather than hardware. Securing accounts therefore comes before cleaning the handset.
- Your activity and device access. Malware, which can arrive after a phishing link or an infected file, can let hackers spy on your activity or remotely access the phone, according to Norton.
- Your calls. Forwarding settings can quietly redirect calls. That is worth checking, but forwarding alone does not prove a hack.
- Your Apple or Google sign-in. Being locked out of either account is an account-level sign that needs prompt recovery.
Several of these signs have innocent explanations. Two or more signs together, or any account-level sign, justify acting on the full checklist below. If the trouble began after you tapped a link in a text, Toll Scam Texts: How To Spot, Stop, And Report Them In 2026 – Cubeguard shows how such messages look and where to report them.
Secure your accounts from a different device
Change passwords from a different device, not the suspect phone. Cape calls this crucial, and its recommended order is accounts, then passwords, then apps, then a security app, with a factory reset last. A trusted laptop or a family member’s phone works. Save the new passwords in a password manager so you are not reusing or memorising weak ones.
- Start with email and your Apple or Google account. These can reset almost everything else, so a thief who holds them holds the rest.
- Check sign-ins and devices. On an Apple Account, review recent sign-ins, trusted devices and security settings. On a Google Account, review recent activity, logged-in devices, security alerts and connected services. Remove anything you do not recognise.
- Move off text-message codes where you can. Cape advises avoiding SMS-based 2FA after a hack because hackers could intercept messages through SS7 attacks, and recommends authenticator apps or biometric verification instead.
- Tell your mobile carrier. The carrier may add fraud alerts or monitoring to your line.
For a comparison of the verification methods mentioned above, see Two-Factor Authentication Examples: 7 Real-World Methods to Secure Your Accounts in 2026 – Cubeguard.
Check and clear call forwarding
Forwarding is quick to test and quick to remove, so check it early. Norton notes that call forwarding doesn’t automatically mean your phone is hacked or tapped, so treat the result as one clue among several.
Dial codes from your carrier
- *#21# shows whether unconditional forwarding is enabled for your number.
- *#62# checks what happens to calls when the phone is turned off, in Airplane Mode or without signal.
- *#002# disables carrier-based unconditional forwarding. According to Norton, running it may also disable your carrier’s voicemail forwarding, so check voicemail afterwards.
Turn off built-in forwarding in settings
Most phones also have a built-in forwarding function that cannot be disabled by dialling a code, so check the settings as well.
- iPhone: go to Settings > Apps > Phone > Calls > Call Forwarding and toggle it off.
- Android: open the Phone app, then Settings > Calls > Call Forwarding and turn off Always forward.
Remove suspect apps and decide whether to reset
Go through the installed apps list and remove anything you did not install. On Android, a reputable security app can add a scan to this step. On iPhone, Apple’s sandboxing means apps cannot scan other apps or system files, as Cape explains, so a scanner there is of limited use and a reset is the more reliable route if signs persist.
Choose by how the phone behaves after you have secured accounts and removed unfamiliar apps:
- Signs have stopped. Keep monitoring accounts and the apps list. A reset is not required.
- Signs continue, or you cannot identify the cause. Move to a factory reset. Cape describes it as the last resort, because it returns the phone to its original state and erases your data.
- You are a high-threat user on iPhone. Consider Lockdown Mode at Settings > Privacy & Security > Lockdown Mode, which Cape recommends for high-threat profiles.
Factory reset on iPhone and Android
Back up only photos, videos, contacts and messages before you reset. Cape advises against backing up apps or system data, as these could be compromised, and a full restore could bring the problem straight back. After the reset, set the phone up as new and reinstall apps yourself.
iPhone
Go to Settings > General > Transfer or reset phone, then tap Erase all content and settings.
Android
Open the reset options, choose Factory data reset, tap Erase all data and enter your password to confirm. Menu names vary a little between makers.
Does a reset remove the hackers?
A factory reset restores the phone to its original state, which clears installed apps and settings from the device. It does not by itself secure your accounts, so the earlier steps still apply. If someone holds a password or an active sign-in, wiping the handset leaves that access intact. That is why account recovery comes first and the reset last.
How malware gets onto a phone
Norton notes that malware can be installed after you tap a phishing link or open an infected file. The mechanism explains two habits worth keeping: do not open unexpected links or files, and install apps you actually chose. After recovery, keep checking your Apple or Google account activity for new devices or alerts, and revisit the reasons in the earlier recovery checklist when you want longer-term habits.
Frequently asked questions
How do I know if my phone was hacked?
Look for several signs together: apps you did not install, unusually fast battery drain, 2FA codes you never requested, logins from unfamiliar places, or being locked out of your Apple or Google account. Any one can have an innocent cause, but account-level signs deserve immediate action.
What should I do first if my phone is hacked?
Use a different device to change passwords, starting with email and your Apple or Google account. Then review sign-ins, remove unfamiliar apps and tell your mobile carrier.
Does call forwarding mean my phone was hacked?
No. Forwarding can be a symptom, but it is not proof by itself. Check its status with the carrier code or in settings, switch it off, and look for other signs.
Is a factory reset enough to remove a hacker?
It restores the phone to its original state, but it is a last resort and does not fix compromised accounts. Back up only photos, videos, contacts and messages beforehand, and change account passwords from another device.
