Most people don’t find out their phone was hacked from a dramatic alert.
They find out because something felt slightly off for weeks and they finally decided to look into it. The battery was draining faster than usual. An app they didn’t install appeared. Their data bill was higher than expected. Small things, individually explainable, that added up to something that wasn’t right.
Here’s how to actually tell — and what to do about it.
The Warning Signs Worth Paying Attention To
Battery Draining Unusually Fast
A phone that’s been compromised often has malware running in the background — collecting data, sending it out, maintaining a connection to a remote server. All of that takes power.
If your battery life has dropped significantly without a change in your usage patterns, without a major OS update, and without the phone being old enough that battery degradation is expected — that’s worth investigating.
The caveat: a new app, a software update, or a change in your routine can also affect battery life. The signal is meaningful when it’s sudden and unexplained.
Data Usage Spikes You Can’t Explain
Malware that’s exfiltrating data — photos, messages, location history, contacts — needs to send that data somewhere. It uses your cellular data or Wi-Fi to do it.
Check your data usage in Settings. Most phones break it down by app. If an app you don’t recognize is using significant data, or if your total data usage has increased sharply without a clear reason — that’s a flag.
Apps You Didn’t Install
This is one of the clearer signals. If there are apps on your phone that you didn’t download and that weren’t pre-installed by the manufacturer or carrier — something is wrong.
Go through your installed apps periodically. If anything looks unfamiliar, search for it before assuming it’s harmless. Some malware disguises itself with names that sound like system utilities.
Phone Running Hot When Not in Use
Background processes generate heat. A phone that’s warm when it’s been sitting idle — screen off, no charging — is doing something you haven’t asked it to do.
Like battery drain, this can have innocent explanations. The concern is when it’s persistent and unexplained.
Strange Behavior: Texts, Calls, Outgoing Messages You Didn’t Send
If contacts are receiving messages from you that you didn’t send, if your call history shows outgoing calls you didn’t make, or if your email sent folder has items you don’t recognize — your accounts or your device have been compromised.
This is a higher-severity signal. Act immediately.
Account Lockouts and Password Reset Emails You Didn’t Request
If you’re receiving password reset emails for accounts you didn’t try to access, or if you’re being locked out of accounts you use regularly — someone may have access to your email or your phone and is attempting to take over your accounts.
This isn’t always phone malware — it could be a separate account compromise — but it warrants immediate investigation.
Slow Performance Without Explanation
A phone that’s suddenly sluggish — apps taking longer to open, the interface lagging — can indicate background processes consuming processing power. Not conclusive on its own, but worth noting alongside other signals.
How Phones Actually Get Compromised
Understanding the methods helps you assess your risk.
Malicious apps. The most common vector. An app that looks legitimate but contains malware — often from third-party app stores outside the official App Store or Google Play, but occasionally slipping through official channels. Once installed, it can access data your permissions allow and sometimes exploit vulnerabilities to access more.
Phishing links. A link in a text message, email, or social media message that takes you to a page that installs something or captures your credentials. Mobile phishing has gotten more convincing.
Public Wi-Fi attacks. On an unsecured network, a sophisticated attacker can intercept traffic or direct you to fake pages. Less common than the above but real.
Physical access. Someone with temporary access to your unlocked phone can install software, change settings, or access accounts. This is often overlooked but is relevant in certain personal situations.
Zero-day exploits. Vulnerabilities in the OS or apps that attackers exploit before patches are available. Typically used against high-value targets rather than randomly. If you’re not a journalist, activist, executive, or otherwise high-profile target, this is a lower-probability concern.
What to Do If You Think Your Phone Is Compromised
Start With the Obvious Checks
Go through your installed apps. Remove anything unfamiliar. Check your permissions — Settings → Privacy → App Permissions on most phones — and revoke anything that seems excessive. An app that needs microphone access but has no reason to have it is worth removing.
Check your accounts. Have any passwords been changed without your knowledge? Are there login sessions you don’t recognize? Most major services show you active sessions and recent login locations.
Change Your Passwords — From a Different Device
If you suspect your phone is compromised, don’t change your passwords on the compromised device. Do it from a computer or another phone that you trust. Start with email and any financial accounts.
Enable two-factor authentication on everything important if you haven’t already — but use an authenticator app rather than SMS if possible, since SIM swapping can compromise SMS-based 2FA.
Run a Security Scan
Both iOS and Android have security features built in. On Android, Google Play Protect scans installed apps for malware. On iOS, the sandboxed app architecture makes traditional malware less common, but it’s not impossible.
Third-party security apps exist for both platforms. Reputable options include Malwarebytes and Lookout. Avoid installing security apps from unfamiliar developers — ironically, fake security apps are a common malware delivery method.
Factory Reset as a Last Resort
If you’ve found evidence of compromise and the above steps don’t resolve it — or if you want certainty — a factory reset is the most reliable way to clean a compromised phone.
Back up your data first, but be selective. Restoring from a full backup on a compromised device can restore the malware along with your data. Restore contacts, photos, and documents — be more cautious about restoring apps and settings.
Update Everything
Keep your OS updated. Security patches exist for a reason, and the vast majority of successful attacks exploit known vulnerabilities that patches have already fixed. The same applies to apps.
If your phone is old enough that it no longer receives OS updates — it’s worth taking seriously as a security risk, especially if you use it for banking or other sensitive accounts.
iPhone vs Android: Which Is More at Risk
The honest answer: both can be compromised, but the risk profile differs.
iOS’s sandboxed architecture and tight App Store review process make traditional malware significantly harder to install. The most common iOS compromises come from phishing, credential theft, and iCloud account compromise — not device-level malware.
Android’s more open ecosystem creates more attack surface. Side-loading apps from outside the Play Store is a common malware vector. Google Play Protect has improved, but the variety of Android manufacturers and OS versions means patch distribution is slower and less consistent than on iOS.
Neither platform is immune. Both benefit from the same fundamentals: OS updates, careful app installation, strong account security, and awareness of phishing.
The cybersecurity threats worth understanding in 2026 go beyond mobile — but the phone is often the weakest link in personal security because it has access to everything.
Most people won’t be targeted by sophisticated attackers. The realistic risks are malicious apps, phishing links, and credential theft through compromised accounts — all of which are preventable with basic habits.
Pay attention to the signals your phone gives you. Act on the unexplained ones. Keep things updated.
The threats are real. So are the defenses.