Stalkerware often starts with access, not hacking: how to check your phone safely

Spyware can exploit familiar routes such as shared account passwords, linked devices and hidden permissions. Check for surveillance carefully: changing settings or removing software can alert an abuser and increase risk.

Suspected stalkerware is rarely a matter of a single rogue app. In most cases, the deeper problem is access: someone has either handled the phone while it was unlocked, or they still know the account credentials that let them see messages, location data and backups. The US Federal Trade Commission says this kind of software can expose location, texts, emails, photos, browsing activity and even microphone recordings, while warning signs often include sudden battery drain, unexpected data use and overheating. It also cautions that confronting the problem can put a person at risk if an abusive partner is involved.

That is why the first step is not a technical one, but a safety one. Before changing settings or deleting anything, it is wise to use a device the other person cannot access and, where relevant, contact a domestic abuse service. The FTC and the National Network to End Domestic Violence both stress that removing surveillance software may alert the person who installed it. Preserving evidence can also matter, because uninstalling the software can erase useful proof.

On Android, the most effective checks focus on the places spyware tends to hide. That means reviewing the full app list, including system apps, and looking closely at special permissions such as Device admin access, Accessibility, Notification access and the ability to install unknown apps. Google says Play Protect scans installed apps and can also check for harmful software from outside Google Play, making it a useful layer of defence, although not a complete guarantee. A suspicious app may wear a bland name such as a system utility or device service, which is why unfamiliar entries deserve closer inspection.

iPhones are handled differently. Apple’s Security Check tools in iOS 16 and later are designed to show who can access shared information, including location, and to stop that sharing quickly if needed. Apple also directs users to check for configuration profiles under General and VPN & Device Management, because these can be used by workplaces and schools, but can also be unfamiliar on a personal device. The company’s guidance further recommends reviewing the devices signed in to an Apple Account, because account-level access is often the real route into a person’s messages, photos and backups.

Account checks are just as important as device checks. Google advises users to review the devices connected to a Google Account and to sign out of anything they do not recognise. Apple’s account settings serve the same purpose. Messaging apps can also reveal hidden access: WhatsApp shows linked devices, while Telegram, Signal, Facebook Messenger and Instagram all display active sessions somewhere in their security or privacy controls. Email forwarding rules are another common blind spot, because they can quietly copy messages elsewhere without changing the inbox itself.

Physical trackers should not be overlooked either. If someone always seems to know where you are, a Bluetooth tracker such as an AirTag, Tile or SmartTag may have been placed in a bag, coat pocket or vehicle. Apple and Android both now include alerts for unknown trackers moving with the user, but manual checks still matter. The same is true for microphone and camera indicators: if the phone shows activity when it should be idle, the app responsible needs to be identified.

If something suspicious is found, the safest response depends on the situation. A straightforward uninstall may be enough for a known app, but a factory reset is often more reliable because it removes installed software and settings. Even then, restoring an old backup without caution can reintroduce the problem. The stronger option is to reset the device, change passwords from a clean device, turn on two-factor authentication and, if necessary, move to a new phone and new accounts. The FTC notes that stalkerware is often disguised under ordinary names, while Apple warns that changing sharing settings can have consequences for safety, which is another reason to proceed carefully.

The key lesson is that stalkerware usually succeeds through ordinary access rather than sophisticated hacking. A strong passcode, a locked screen, unique account passwords and up-to-date software remove most of the opportunities it needs. So does checking regularly for unfamiliar devices, profiles and sharing settings. For anyone who suspects a partner, ex-partner or other person is monitoring them, the most important rule remains the same: use a safe device to seek help before making changes that could escalate the risk.