Short answer
The FTC lists signs worth taking seriously: the battery drains faster, the phone uses more data, overheats or turns off and on by itself — and, most telling, someone knows things you only said or did on your phone. Battery and data alone often have ordinary causes, so check your accounts too: many “hacked phones” are really an email, iCloud, Google or WhatsApp account with an unknown device signed in. If you suspect stalkerware installed by someone you know, think about safety before removing it — the FTC warns that removal can alert that person. Then update the phone, review apps and profiles, run Play Protect or Safety Check, and change passwords from a device you trust.
Signs worth checking
| Sign | What it can mean | Where to look |
|---|---|---|
| Battery drains fast, phone runs hot | A busy app, an old battery — or monitoring software running in the background | Battery usage by app in Settings |
| Unusual data use | An app sending data out | Mobile data usage by app |
| Turns off and on by itself | A software fault — or remote interference | Pending updates and recently installed apps |
| Someone knows your location, chats or calls | Location sharing, a synced account, a linked device — or stalkerware | Location sharing, linked devices, account sessions; on iPhone, Safety Check |
| Login alerts, unknown devices | Your account was taken over, not necessarily the phone | Devices signed in to Apple, Google, email and WhatsApp |
| Apps or profiles you didn’t add | Possible spyware or a management profile | App list; iPhone: Settings → General → VPN & Device Management; Android: device admin apps in Security settings |
Is it the phone or the account?
Someone who has your password or a stolen session can read mail, photos and chats that sync to the cloud — without ever touching your phone. So before you reset anything, check the accounts:
- Signed-in devices on Apple, Google, Microsoft and social accounts — see where to check logged-in devices.
- WhatsApp linked devices: a WhatsApp Web or desktop session lets another computer read your chats. Log out of any you don’t recognise.
- Connected apps and third-party access, plus hidden email forwarding rules.
If you find an unknown session, sign it out and change the password from a device you trust. If accounts were taken over even with two-step verification on, read session hijacking explained.
If you suspect stalkerware
- Think about safety first. The FTC warns that removing stalkerware could alert the person who installed it and escalate the abuse. Talk to a domestic violence advocate before acting — in the US, the National Domestic Violence Hotline (1-800-799-7233).
- Use a safe device — a friend’s phone or a new prepaid one — to contact advocates or the police, not the phone you suspect.
- Document what is happening and save photos and files you want to keep before you reset or replace anything.
- On iPhone, use Safety Check (iOS 16 or later: Settings → Privacy & Security → Safety Check) to review who and what you share with. Apple notes that people may notice when you stop sharing.
- Get specialist help: the Coalition Against Stalkerware lists support organisations by country.
Clean up the phone
- Update the operating system and every app — updates often fix the security holes spyware uses.
- Delete apps you don’t recognise, and on iPhone remove unknown profiles under VPN & Device Management.
- On Android, run Play Protect from the Play Store (profile picture → Play Protect → Scan) and keep it switched on; it checks apps for harmful behaviour.
- Change passwords from another device and turn on two-step verification, starting with email.
- Still suspicious? Back up photos and contacts, factory-reset the phone and reinstall apps from the store. The FTC advises not restoring apps from a backup, which could reinstall the spyware. A new phone with accounts the abuser can’t reach is the safest option.
Higher risk? Lockdown Mode
Journalists, activists and others who may be targeted by sophisticated, paid-for spyware can turn on Apple’s Lockdown Mode: an optional, extreme protection that deliberately limits some apps, websites and features. Most people don’t need it — for them, updates, a strong passcode, two-step verification and keeping physical control of the phone do most of the work, as the FTC recommends.
Frequently asked questions
Does a factory reset remove spyware?
According to the FTC, a full factory reset may remove stalkerware — as long as you don’t restore apps from a backup afterwards. A new phone with accounts the other person can’t access is the safest option.
Can someone read my WhatsApp without my phone?
Yes, if a linked device such as WhatsApp Web was set up. Open Linked devices in WhatsApp and log out of any session you don’t recognise.
Is my phone hacked if the battery drains fast?
Not necessarily. Old batteries and busy apps cause the same thing. Take it seriously when it comes with other signs — especially someone knowing private details.
Should I delete stalkerware as soon as I find it?
Not before you think about safety. The FTC warns that removal can alert the person who installed it. Document it and talk to an advocate first.
Sources: FTC — stalkerware: what to know, Apple — Personal Safety User Guide and Safety Check, Apple Support — about Lockdown Mode, Google Play Help — Google Play Protect, WhatsApp Help — how to unlink a device, Coalition Against Stalkerware