How to identify and respond to suspicious activity on your phone

Security experts highlight the importance of checking linked accounts, suspicious app activity, and account settings, rather than the device itself, when encountering unusual phone behaviour. Immediate account and carrier protections, combined with careful device management, are essential to prevent and respond to potential compromises.

A phone that suddenly drains faster, runs hotter, or starts behaving oddly is not automatically compromised, but a cluster of warning signs deserves attention. Security experts cited by TechCity say the first place to look is not the handset itself, but the accounts linked to it. The Federal Trade Commission has warned that what feels like phone intrusion is often account access elsewhere, particularly through email, Apple Account, or Google logins.

That distinction matters because account access is usually the quickest issue to check and the easiest to fix. On an iPhone, the device list sits in Settings under the user’s name. On Android, Google’s Security page shows the devices signed in to the account. Any unfamiliar phone, tablet, or computer should be signed out immediately, followed by a password change. McAfee and AVG both note that unexpected battery drain, unfamiliar apps, overheating, and strange device behaviour are among the common signs worth watching for.

Other clues can point to spyware or a broader compromise. Unusual data usage can suggest that information is being sent out of the device, while a camera or microphone indicator appearing without explanation may mean an app is active in the background. Kaspersky also flags rapid battery loss and data spikes as signs that a phone may be monitored. On Android, suspicious apps can hide in permission-heavy areas such as Accessibility, Notification access, and Device admin settings, so those menus are worth checking carefully.

The presence of login codes or password-reset emails that were not requested is another warning sign. In some cases, the problem is not a hacked handset at all but a stolen phone number. If a device suddenly shows “No Service” or “SOS” in a place where signal is normally stable, that can indicate a SIM swap, where an attacker has moved a number to a new card. The practical response is to contact the mobile carrier from another phone straight away.

If there is any possibility that a partner, former partner, or family member installed tracking software, caution is essential. The Federal Trade Commission has advised that removing software too quickly can alert an abuser and potentially escalate the situation. In those cases, victims are encouraged to speak to a domestic violence advocate before taking action. The National Domestic Violence Hotline offers support by phone, chat, or text, and iPhone users can also use Safety Check to cut off location sharing, revoke shared access, and review app permissions.

The remediation order matters. Security guidance from TechCity and other mobile-security advisories puts the email account first, because it is the recovery hub for most other services. Passwords should then be changed for financial and social accounts, ideally from another device. Next comes the mobile number, with carrier-specific protections such as account locks, number locks, SIM protection, and port-out protection to reduce the risk of a repeat attack. Two-factor authentication should then be enabled, with an authenticator app or passkey preferred over text-message codes, since SMS can be intercepted through a SIM swap.

After accounts and number security are addressed, the phone itself should be cleaned up methodically. On iPhone, privacy settings and device management profiles deserve review; on Android, built-in security tools such as Play Protect can be used to scan the device. A simple restart can also help, because some malicious tools do not survive a reboot. If problems persist, a factory reset may be necessary, but only after backing up essential data and confirming account passwords. TechCity recommends reinstalling apps manually from official stores rather than restoring everything blindly from an old backup, which could reintroduce the problem.

Prevention is mostly about reducing opportunity. Automatic software updates, official app stores, stronger passcodes, and careful handling of unexpected links all lower the risk. Weekly reboots are also sensible, and so are periodic checks of the devices signed in to Apple or Google accounts. Those two steps, paired with carrier-level number protection, close off the most common routes attackers use.