Your phone's acting oddly and a little voice says: have I been hacked? Usually the answer is no. Phones slow down, batteries age and apps misbehave for boring reasons. But sometimes there is something wrong, and it's worth knowing the difference. Here are the signs that genuinely matter, the ones that usually don't, and what to do about it, step by step.
Signs worth taking seriously
The UK's National Cyber Security Centre (NCSC) lists these as the signs a device may have been compromised:
- It's running slowly, restarting by itself, or apps close or open on their own.
- Pop-ups from apps you don't recognise, asking you to do unexpected things.
- Friends say they've had odd messages from you — adverts, links or requests for money you never sent.
Other signs that are worth a closer look:
- Apps you don't remember installing, especially ones with vague names or no icon.
- Emails saying someone signed in to your account from a new device or place you don't recognise, or password-reset codes you didn't ask for.
- A sudden jump in mobile data use that doesn't match anything you've done.
- You're suddenly locked out of your email, WhatsApp or social media.
One sign on its own is rarely proof. Two or three together, especially messages you didn't send or logins you didn't make, are worth acting on today.
Things that usually aren't hacking
- The battery drains faster than it used to. Batteries wear out; a two- or three-year-old phone won't last as long as it did.
- The phone gets warm. Charging, video calls, games and big updates all do that.
- Clicks or noises on calls. That's the network, not someone listening in.
- You talked about something and then saw an advert for it. Creepy, but it's almost always down to what you searched, bought or clicked, and what apps already know about you. Our phone clean-up guide helps you cut that back.
- A pop-up in your browser says “your phone is infected”. That's the scam, not a diagnosis. Close the page and don't call any number it shows.
What to do, step by step
1. Update the phone and your apps
Updates fix the holes most attacks rely on. On an iPhone, go to Settings › General › Software Update. On Android, open Settings and search for “update”. Then update your apps from the App Store or Play Store.
2. Remove apps you don't recognise
Go through your app list and delete anything you don't know or don't use. On Android, also check which apps have been given extra control over the phone: open Settings, search for “device admin”, and switch off anything you don't recognise before deleting it. While you're there, look at which apps can use your location, microphone and camera, and take those permissions away where they aren't needed.
3. Change your important passwords, from a different device
Start with your email, because it can reset everything else, then your bank, Apple or Google account, and anything else that matters. If you think the phone itself is compromised, do this from a computer or another phone you trust. Use a different password for each (a password manager makes this painless).
4. Turn on 2-step verification
This means a password alone isn't enough to get into your account; a code or a prompt on your phone is needed too. It's the single biggest step you can take. Your email, Apple or Google account, and social media all offer it in their security settings.
5. Check who's signed in to your accounts
- Google: run Security Checkup. It shows the devices signed in to your account, recent security events and apps with access, and lets you remove anything you don't recognise.
- iPhone: if you're worried someone you know has access to your phone or accounts, use Settings › Privacy & Security › Safety Check (iOS 16 or later). It lets you review and stop sharing with people and apps, or do an Emergency Reset that stops all sharing at once.
- WhatsApp and social media: check the “linked devices” or “where you're logged in” list and log out anything you don't recognise.
6. If it's still not right: reset the phone
For phones and tablets, the NCSC says a factory reset is the safest fix, because antivirus apps work differently on mobiles. Back up your photos and contacts first, then reset from Settings (search for “reset”), and only reinstall apps you actually need. Our honest antivirus guide explains why you usually don't need to buy anything.
For the very few at serious risk
Journalists, activists and people in public roles can be targeted by highly sophisticated attacks. Apple's Lockdown Mode (Settings › Privacy & Security › Lockdown Mode) is an extreme protection built for them. It limits some features on purpose. As Apple says, most people will never be targeted this way, so most of us don't need it.
When to get help
- If money has gone, or someone has used your accounts to spend, ring your bank straight away on 159 or the number on your card, then report it. Our guide to reporting a scam lists who to tell.
- If a reset doesn't fix it, the NCSC recommends getting expert help, for example from your phone shop or network.
- If you think someone close to you is monitoring your phone, your safety comes first. Safety Check on iPhone was built for exactly this, and specialist domestic abuse services can help you plan.
Keep it that way
Most hacks start with a password that was reused, a link that got tapped, or an app nobody needed. Keep the phone updated, lock the apps that matter (see how to lock apps), use 2-step verification, and be wary of anyone rushing you. That covers the vast majority of what's out there.