How to Tell If Your Phone Is Hacked and What to Do Now

For a few days your phone has felt off. The battery lasts half as long, there's an app you don't remember installing, a friend got a message from you that you never wrote, or your bank has flagged a login you didn't make. It's completely natural to wonder: is my phone hacked? Sometimes it is, often it isn't, and the good news is you can find out without being a tech expert.

Here's how to tell if your phone is hacked, what to check on Android and iPhone, the truth about those codes that supposedly show whether you've been hacked, how to clean your phone and what to do if someone has already used your WhatsApp, your social media or your banking. And if nothing has happened yet, at the end you'll find what really keeps a phone safe, which is a lot simpler than it sounds.

In this article

1. What "my phone is hacked" usually means
2. Signs your phone is hacked
3. How to check your phone on Android and iPhone
4. Myths: codes and numbers that "show if you're hacked"
5. How to clean a hacked phone, step by step
6. If your WhatsApp, accounts or bank have already been used
7. When to get a forensic check of your phone
8. Imagine this happens to you
9. How to stop your phone being hacked again
10. Beware of anyone offering to "unhack" your phone
11. If money was taken, don't let it go

What "my phone is hacked" usually means

When people say their phone has been hacked, they usually mean one of three things, and it helps to know which one is yours because the fix is different.

The first, and by far the most common, is that someone got into an account, not the phone itself: your WhatsApp, Instagram, email, or your Google or Apple account. It happens when someone gets hold of your password or the code sent to you by text, very often by tricking you. The phone is fine, but your account is being used from somewhere else.

The second is that a malicious app is installed, what's usually called malware: a program that steals your data, reads your texts to grab your bank codes or lets someone control your screen remotely. It almost always gets there because somebody talked you into installing it, through a link, a call or a message.

The third is that someone is spying on you with a monitoring app, known as stalkerware. It's usually installed by someone who has had your phone in their hands, sometimes a person close to you, like a partner or an ex.

There's a fourth case, the multimillion-dollar spyware you read about in the news, but Apple makes it clear that it targets a very small number of people because of who they are or what they do. If you're an ordinary person living an ordinary life, yours is almost certainly one of the first three, and all of them can be fixed.

Signs your phone is hacked

No single sign proves anything, since an old phone gets slow too and a badly made app can drain the battery. What should make you suspicious is several of these showing up together, or starting right after you tapped a link or installed something:

• Apps you don't remember installing, or an app that vanishes from the menu but keeps running in the background.
• Messages, emails or posts you didn't send. Often you only find out because a friend asks.
• Sign-in alerts for your email, WhatsApp or social media from a device or place you don't recognize, or verification codes arriving that you never requested.
• Bank transactions that aren't yours, cards added to another phone, or new payees.
• A battery that drains fast, data use through the roof or a phone that gets hot while you're not doing anything.
• Ads and pop-ups that appear on their own, even outside the browser.
• The phone turns on, restarts or opens apps by itself, or settings change that you never touched.
• Someone knows things that were only on your phone, like conversations or where you've been. This one points most strongly to a spy app.

If you recognize one or two, there's no need to stress: there's usually a simple explanation. If you recognize several, keep reading and let's check.

How to check your phone on Android and iPhone

You don't need to install anything unusual to check your phone. Both systems come with official, free tools, and fifteen minutes is usually enough to know where you stand.

On Android

1. Run Google Play Protect. Open the Play Store, tap your profile picture at the top right and go to Play Protect. Make sure scanning is on and run a scan. Google explains that Play Protect looks for harmful apps, including ones that didn't come from the store, and warns you about them or disables them.
2. Go through your app list in Settings, under apps, and look for anything you don't recognize or didn't install yourself. Be especially wary of generic names like "System Update" or "Service".
3. Check the sensitive permissions. See which apps have accessibility access, device admin rights and access to your texts. Accessibility is meant to help people with disabilities, but it also lets an app read your screen and tap for you, which is why it's the favourite of apps that steal banking logins. The exact menu names vary by phone brand.
4. Run your Google Account security checkup at myaccount.google.com/security-checkup, which shows connected devices and recent sign-ins.

On iPhone

A lot of people search for how to know if their iPhone is hacked. Malicious apps are rarer on an iPhone, but someone getting into your account is still very possible. Here's what to look at:

1. Use Safety Check. It's in Settings, under Privacy & Security. Apple explains that Safety Check lets you see who has access to your information and location, which devices are signed in to your Apple Account and which permissions your apps have, and cut it all off at once if you need to.
2. Review the devices on your Apple Account by tapping your name in Settings. If there's one that isn't yours, remove it and change your password.
3. Look for installed profiles under Settings, General, VPN & Device Management. If it isn't a work phone and there's a profile you don't recognize, that's a red flag.
4. Know what real Apple threat notifications look like. If Apple detects an advanced spyware attack against you, it alerts you on screen, in Settings and by email. Apple says these alerts never ask you to click links, install anything or share codes, so an "Apple alert" that does is a scam.

In your accounts, whatever phone you use

In WhatsApp, go to Settings and Linked devices and log out of any session you don't recognize, especially a WhatsApp Web session open on a computer that isn't yours. Do the same with active sessions in your email, Instagram, Facebook or TikTok. Plenty of "hacked phones" are really just this, and logging out and changing the password fixes it.

Myths: codes and numbers that "show if you're hacked"

You've probably seen a video or a message with a magic code that, dialled on your keypad, tells you whether you've been hacked. It doesn't exist. The codes going around are network or phone functions, and none of them scans for spyware. Here's what they actually do:

• *#21# tells you whether all your calls are being forwarded to another number. *#61#, *#62# and *#67# check forwarding when you don't answer, when your phone is off or when you're busy.
• ##002# cancels all call forwarding at once, including to voicemail. Vodafone UK lists it in its help pages and it works on most networks. Some US carriers use different codes, so if it doesn't work, check call forwarding in your phone's settings or ask your carrier.
• *#06# just shows your IMEI, your phone's serial number. It's worth writing down in case your phone is stolen, but it says nothing about hacking.

Checking call forwarding still makes sense, for one very specific reason. A common trick is a message or call, supposedly from your carrier, asking you to dial a code "to fix your line". That code forwards your calls to the scammers, who then ask WhatsApp to send your verification code by voice call, take over your account and message your contacts asking for money. So if anyone asks you to dial a code starting with *21* or **21*, hang up. And if you already did, take a screenshot of what *#21# shows, cancel the forwarding with ##002# and call your carrier.

How to clean a hacked phone, step by step

If, after checking, you think your phone really has been hacked, this is what to do, roughly in this order. It doesn't need to be perfect; what matters is starting today:

1. If money is involved, take screenshots before you delete anything: of the suspicious app, its permissions, the messages and your bank transactions. If you're going to report it, the phone is evidence.
2. Disconnect from the internet for a moment by turning off Wi-Fi and mobile data, so the app stops sending information while you work.
3. Uninstall the suspicious app. On Android, if it won't let you, first remove its device admin or accessibility permission. Google has a page on how to remove malware on Android.
4. Update the system and all your apps, because updates close the holes attackers exploit.
5. Change your passwords from another trusted device, not from the affected phone. Start with your email, which is the key to everything else, then your bank, your Google or Apple account, WhatsApp and social media. Turn on 2-step verification everywhere.
6. If the symptoms continue, factory reset the phone. It wipes everything on it, including the malicious app. Back up your photos and contacts first and have your Google or Apple password to hand, as Google explains in its guide to resetting an Android. When you restore, don't reinstall the app that caused the trouble.

The UK's National Cyber Security Centre also has clear advice on recovering a hacked account if you get stuck on a particular service.

If your WhatsApp, accounts or bank have already been used

If the hack has gone beyond the phone, the priority is to stop the damage as soon as possible. There's a lot you can do, and every hour counts, so it's worth getting started today.

• WhatsApp. Re-register your number on your own phone to kick the intruder out, and turn on two-step verification, which adds a PIN nobody can guess. Warn your contacts another way not to pay anything requested from your account. We go into this in WhatsApp scams: what to do.
• Social media and email. Use each platform's official "my account was hacked" option, change the password and log out of every session. If someone is using your name to trick others, see identity theft: what to do.
• Your bank. Call now on the number on its website or the back of your card, ask them to block your cards and online banking and to review devices, payees and transactions, then follow up in writing. In the US, the CFPB explains that reporting unauthorized transfers quickly limits what you can be held responsible for. In the UK, the FCA says a payment you didn't authorize should be refunded by the end of the next business day, and the bank can only refuse in narrow cases, such as fraud on your part. It also points out that the use of your password or PIN may not, on its own, be proof that you authorized a payment, which matters a lot when it was malware that made it. We cover the details in bank fraud: will my bank refund me?.
• Report it. Getting into someone's phone or accounts without permission is a crime: in the UK under the Computer Misuse Act 1990, and in the US under the federal Computer Fraud and Abuse Act as well as state laws. In the US, report it at ReportFraud.ftc.gov and to the FBI's IC3; in the UK, to Report Fraud. Our guide on how to report a scam walks you through it.

When to get a forensic check of your phone

Most of the time you won't need one, and the steps above will sort things out. But it's worth having a digital forensics expert look at your phone when money has been taken and your bank doubts it wasn't you, when you suspect someone close to you is spying on you, when you want to report it and need to prove what happened, or when the hack affects your work or a court case.

A forensic expert examines the phone and your accounts using methods nobody can challenge later, finds the app or login that was used, dates every step and explains it in an expert report that banks, police and judges understand. That's why it matters so much not to reset the phone before getting advice if the case is serious. We explain exactly what they do in crypto scam lawyer and blockchain forensics, and the same applies to any hack.

Imagine this happens to you

Imagine someone calls claiming to be from your bank, sounding very professional, and tells you they've detected a security problem on your phone. To fix it, they ask you to install a "protection" app from a link they text you. You install it, grant the permissions it asks for and hang up convinced it's all sorted. Two days later, your banking app shows three transfers you never made.

In a situation like that, the most useful thing would be to call the bank straight away on its official number to block everything and ask them to try to stop the transfers, screenshot the app and its permissions, uninstall it, change your passwords from another device, put your claim in writing and report it. Because you didn't authorize those payments, you'd have strong grounds for a refund, and a forensic expert can prove it was the app that made them. It's only an example, but it shows how many of these cases start.

How to stop your phone being hacked again

If it hasn't happened to you, or you don't want it to happen again, the good news is that almost every phone hack affecting ordinary people can be avoided with a few habits:

• Only install apps from Google Play or the App Store, and never one someone asks you to install over the phone or through a link, even if they say they're your bank, the police or your carrier.
• Never share a code you receive by text, not with someone claiming to be WhatsApp, your bank or a friend. Nobody legitimate needs it.
• Turn on two-step verification for WhatsApp, email, social media and your bank, and use a different password for each.
• Use a screen lock only you know and don't hand your unlocked phone to anyone. It's the only way to stop someone close to you from installing a spy app.
• Keep your phone updated, and if it no longer gets security updates, think about replacing it.
• Be wary of urgency. A message saying your account will be blocked today or a "technician" who needs to get into your phone right now is almost always the start of a scam. The most common ones are in smishing: fake bank texts and vishing: spoofed bank calls.

Beware of anyone offering to "unhack" your phone

As soon as people look for help after a hack, profiles on social media, ads and comments appear from so-called experts promising to recover your account, "trace the hacker" or get 100% of your money back, always for an upfront fee. We understand wanting it fixed right now, but anyone who guarantees results and asks you to pay first is usually running a second scam. Before paying anyone, read how to spot crypto recovery scams.

If money was taken, don't let it go

Having your phone hacked is infuriating and can feel embarrassing, but it can happen to anyone, and the tricks behind it are very well prepared. If it ended in payments, transfers, crypto or stolen accounts, the sooner you act, the more options you have.

We are lawyers and expert investigators specialising in online scams, cryptocurrency and cybercrime, and every case is handled by a lawyer or an expert investigator. We examine your phone and accounts to show what happened, prepare the claim to your bank or the platform and ask the authorities for whatever is needed to try to freeze the money. In many cases the money is recovered, especially if you act fast. At Kironic we do everything we can to recover your money: send us your case and we'll look at it together.