When a “your phone has been hacked pop up” appears, treat it as a scam first: it is typically a browser-based message, not a system alert. Close it without tapping anything inside it, then check for real signs of infection.
The wider habits that keep a phone clean are covered in our guide on how to protect yourself from hackers.
Why the alert appears: a script, not a scan
A hacked-phone pop-up is a scare tactic delivered by a website, not a finding by your phone. On Android, these alerts are not generated by the phone’s operating system. Websites trigger them with scripts designed to scare users, which is why they are a browser hijack rather than an infection. A web page also cannot perform a real scan of an Android device, so any instant “scan results” on a page are not legitimate.
On iPhone the verdict is the same. Pop-ups claiming your iPhone has been hacked are not real; cybercriminals create them. The danger lies in what happens after you engage: once you tap, malware can start downloading to the device.
How to recognise the wording
Scam pop-ups lean on urgency. Keeper Security points out that real security warnings do not use urgent, alarming language, and gives typical phrases such as “Your device has been hacked” and “Immediate action is required”. Treat that tone as the signal, whatever the pop-up claims to know about your phone.
Some scams go further and pretend to be Apple support, through pop-ups, calls or email. Do not phone a number printed in a pop-up. Apple also does not send account-deletion warnings by email; per Keeper Security, Apple will never message you in this way.
Fake alert or real infection
The practical difference is who did the work. A fake alert needs nothing from you except attention. A genuine Android infection needs you to have installed something, which is the key to telling the two apart. Android blocks automatic app installations unless you manually enable installing from unknown sources, so a web page cannot quietly put an app on your phone.
| Check | Fake pop-up | Real infection |
|---|---|---|
| Where it comes from | A website script running in the browser | An app on the phone, usually an unknown APK file you installed or an app you granted special permissions |
| Tone | Urgent, alarming, demands immediate action | Often no message at all; the symptoms show up in how the phone behaves |
| Typical signs | Instant “scan results” in a web page, warning buttons, a call-this-number prompt | New apps you did not install, frequent ads, battery drain, high data use |
| iPhone angle | Not a real alert; closing the window is the response | Raised risk after jailbreaking, which allows unapproved apps that may contain malware |
Comparison drawn from One Click Technologies’ Android guidance and Keeper Security’s iPhone guidance.
If the pop-up is the only symptom and you have not installed anything new, a fake alert is by far the likelier explanation. If you notice the symptoms in the right-hand column, move past the pop-up and audit the apps themselves.
Removing the pop-up
Start with containment, then clean the browser. The order matters because tapping anything inside the alert is what gives a scam its payoff.
Android
- Leave the alert alone. Do not press any buttons inside the warning, even one labelled Close; such buttons can redirect to malicious pages.
- Force stop the browser. Go to Settings, open Apps, select Chrome and tap Force Stop. Use the equivalent entry if you browse with a different app.
- Clear cache and cookies. Open the browser’s settings and make sure cache and cookies are both selected before clearing.
- Remove notification permissions. Check the browser’s notification settings and delete unknown websites from the allowed list, so a site you once approved cannot keep pushing alerts.
- Scan the device. Install a trusted antivirus app from the Play Store and run a complete scan.
iPhone
The iPhone response is shorter because the alert is only a web page. Do not tap anything in it; just close the window. Then use the browser’s own settings to clear stored site data, since that is where the page may have left traces. Apple’s guidance is not needed to see why this works: the pop-up has no system access, so removing the page and its stored data removes the nuisance.
If you already tapped
Clicking can start a malware download, and malware can take data from your device and also private information from other devices on the same network. That makes a quick audit worthwhile after any tap. For a closer look at one serious malware category, see How Ransomware Works: Inside Attacks, Payments, and Practical Defenses (2026 Guide) – Cubeguard.
Checking apps and browser for a hijack
A one-off pop-up is annoying; one that keeps returning needs a closer look at apps and browser settings. Open Settings and then Apps on Android and read through the list for anything you do not remember installing. Unexplained new apps are the first sign of a real infection listed by One Click Technologies, ahead of frequent ads, battery drain and high data use. Remove unfamiliar entries, then rerun the scan.
When the pop-up keeps coming back
Persistence usually points at the browser, not the hardware. A forum user on BleepingComputer reported that a factory reset on an older Android tablet only changed the advertisement and pop-up text. That is one report, not a rule, but it fits the pattern that web-based pop-ups are not fixed by wiping the device. Before resetting anything, recheck notification permissions, clear the browser data again and look for apps you did not install.
Preventing the next fake alert
Prevention comes down to limiting what a website can ask of you and what can run on the phone.
- Install from official stores only. Keeper Security’s advice for iPhone is to download apps only from the official App Store; Android users should use the Play Store for the same reason.
- Keep unknown-source installs switched off. Because Android blocks automatic installs unless you enable them manually, leaving that setting off removes the main route to a genuine infection.
- Update iOS. Recent versions contain bug fixes, new security features and overall performance improvements.
- Turn on multi-factor authentication for your Apple ID. It gives the account an extra layer of security, which limits the damage if a password is stolen after a scam.
- Do not jailbreak an iPhone. Doing so allows unapproved apps that may contain malware.
- Audit notification permissions. Remove unknown websites from the browser’s allowed list.
If you also want protection against the heavier threats that fake alerts can lead to, the defensive routines in How To Prevent Ransomware Attacks: A Practical 2026 Guide To Protecting Your Data – Cubeguard overlap with the habits above.
Frequently asked questions
Can a website really scan my phone for viruses?
No. A website cannot perform a real scan of an Android device, so instant scan results shown in a browser page are not legitimate.
Does Apple warn me by email that my account will be deleted?
No. Keeper Security notes that Apple will never message you in this way, so treat such an email as part of a scam.
Will a factory reset stop the pop-up?
Not necessarily. One forum report describes a reset that only changed the pop-up text. Clearing browser data and notification permissions addresses the source more directly.
How can I tell if my Android phone is genuinely infected?
Look for new apps you did not install, frequent ads, battery drain or high data use. An infection also requires an unknown APK to be installed or special permissions to be granted, so a pop-up alone does not prove it.
