Your phone's acting oddly and a little voice says: have I been hacked? Usually the answer is no. Phones slow down, batteries age and apps misbehave for boring reasons. But sometimes there is something wrong, and it's worth knowing the difference. Here are the signs that genuinely matter, the ones that usually don't, and what to do about it, step by step.
Signs worth taking seriously
The UK's National Cyber Security Centre (NCSC) lists these as the signs a device may have been compromised:
- It's running slowly, restarting by itself, or apps close or open on their own.
- Pop-ups from apps you don't recognise, asking you to do unexpected things.
- Friends say they've had odd messages from you: adverts, links or requests for money you never sent.
Other signs that are worth a closer look:
- Apps you don't remember installing, especially ones with vague names or no icon.
- Emails saying someone signed in to your account from a new device or place you don't recognise, or password-reset codes you didn't ask for.
- A sudden jump in mobile data use that doesn't match anything you've done.
- You're suddenly locked out of your email, WhatsApp or social media.
One sign on its own is rarely proof. Two or three together, especially messages you didn't send or logins you didn't make, are worth acting on today.
What usually isn't hacking
- The battery drains faster than it used to. Batteries wear out; a two- or three-year-old phone won't last as long as it did.
- The phone gets warm. Charging, video calls, games and big updates all do that.
- Clicks or noises on calls. That's the network, not someone listening in.
- You talked about something and then saw an advert for it. Creepy, but it's almost always down to what you searched, bought or clicked, and what apps already know about you. Our phone clean-up guide helps you cut that back.
- A pop-up in your browser says “your phone is infected”. That's the scam, not a diagnosis. Close the page and don't call any number it shows.
The detail behind those five steps
- Permissions, while you are deleting apps. Look at which apps can use your location, microphone and camera, and take those permissions away where they aren't needed.
- Passwords after email: your bank, your Apple or Google account, then anything else that matters, with a different password for each. A password manager makes this painless.
- Google Security Checkup shows the devices signed in, recent security events and apps with access, and lets you remove anything you don't recognise.
- iPhone Safety Check (Settings › Privacy & Security › Safety Check, iOS 16 or later) is the one to use if you think someone you know has access. Emergency Reset stops all sharing at once.
If it's still not right: reset the phone
For phones and tablets, the NCSC says a factory reset is the safest fix, because antivirus apps work differently on mobiles. Back up your photos and contacts first, then reset from Settings (search for “reset”), and only reinstall apps you actually need. Our honest antivirus guide explains why you usually don't need to buy anything.
Do you need Lockdown Mode?
Journalists, activists and people in public roles can be targeted by highly sophisticated attacks. Apple's Lockdown Mode (Settings › Privacy & Security › Lockdown Mode) is an extreme protection built for them. It limits some features on purpose. As Apple says, most people will never be targeted this way, so most of us don't need it.
When to get help
- If money has gone, or someone has used your accounts to spend, ring your bank straight away on 159 or the number on your card, then report it. Our guide to reporting a scam lists who to tell.
- If a reset doesn't fix it, the NCSC recommends getting expert help, for example from your phone shop or network.
- If you think someone close to you is monitoring your phone, your safety comes first. Safety Check on iPhone was built for exactly this, and specialist domestic abuse services can help you plan.
One honest caveat, because it's the commonest false alarm: a phone that's slow, warm and flat straight after a big software update almost certainly hasn't been hacked. It's doing background work, and it settles down. See why an iPhone feels slow after an update before you worry.
How to keep it that way
Most hacks start with a password that was reused, a link that got tapped, or an app nobody needed. Keep the phone updated, lock the apps that matter (see how to lock apps), use 2-step verification, and be wary of anyone rushing you. That covers the vast majority of what's out there.
And if you've seen a video claiming the problem is hidden hardware rather than anything you did, we've weighed that evidence up: are there spy chips in your phone?