How to Know if Your Phone Is Hacked: 12 Signs (2026)

Phones get blamed for a lot. A battery that no longer lasts the afternoon, a screen that stutters, ads that follow you around — none of that means a hacker is in there. Real phone compromise in 2026 looks different, and for people over 60 it almost never starts with a technical break-in. It starts with a phone call, a text or a pop-up that persuades the owner to open the door themselves.

This guide separates the signs that matter from the ones that do not, gives you a check you can finish in five minutes on either an iPhone or an Android, and lists the exact order of steps to take if something is wrong. Nothing here requires a technician.

12 real signs your phone is hacked

Count how many of these are true right now. One is rarely meaningful. Three or more, especially the account-related ones, is a genuine warning.

1. Apps you never installed. An icon appears that you do not recognize, or an app reappears after you delete it.
2. Password reset codes you did not request. Someone is trying your accounts, and if a code arrives the moment you are on the phone with a stranger, they are trying to get you to read it out.
3. Messages sent from you that you did not write. Friends reply to a text or email you never sent, often a short link.
4. Pop-ups outside the browser. Warning boxes or ads that appear on the home screen or while using an unrelated app.
5. Unfamiliar numbers on your phone bill. Calls or premium-rate texts to numbers and countries you have never dialed.
6. A sudden jump in data usage. Check the monthly total in settings; a doubling with no change in your habits is worth explaining.
7. The phone is warm while idle. Not warm during a video call — warm when sitting on the table doing nothing.
8. Battery life collapsed in days, not months. Gradual decline is age. A cliff over one week is not.
9. Settings that change themselves back. Location or permissions you turned off are on again the next day.
10. The screen reacts when you are not touching it, or the phone wakes and dims on its own repeatedly.
11. New profiles, VPNs or accessibility services you did not set up. This is the single strongest sign after a remote-support call.
12. Your bank or email shows a login from a device or place you do not know.

What is almost always something else

Before you worry, rule these out. They cause the majority of scares, and in most of the cases we hear about, the phone was fine.

• Slowness and short battery life on a phone three or more years old — batteries degrade, and updates get heavier.
• Browser pop-ups on one bad website. If they only appear on a particular page, close the tab; that is the site, not your phone.
• A flood of spam calls and texts. That means your number is on a list, not that your phone is compromised.
• Ads that seem to know what you discussed. Advertising profiles are built from what you and people near you search and buy.
• A warning that says your phone has viruses and to call a number. That warning is itself the scam, every single time.

The 5-minute check on an iPhone

1. Settings, then General, then VPN & Device Management. If there is any configuration profile or VPN you did not add, remove it. This should normally be empty.
2. Settings, then Accessibility. Nothing here should be on that you did not turn on yourself.
3. Settings, then your name at the top. Scroll to the device list; sign out any device you do not own.
4. Settings, then Privacy & Security, then Safety Check, and run the review of who has access to your information.
5. Settings, then Privacy & Security, then App Privacy Report, and look for apps using the microphone, camera or location in the background.
6. Settings, then Apps, then Mail, and check for forwarding or filter rules you did not create. Also check them in your webmail.
7. Settings, then General, then Software Update, and install anything pending.

The 5-minute check on Android

Menu names vary slightly by brand (Samsung, Google Pixel, Motorola), but every step exists on all of them.

1. Play Store, tap your profile picture, then Play Protect, then Scan. Let it finish.
2. Settings, then Apps, and sort or scan for recently installed items. Uninstall anything you do not recognize, especially remote-support apps.
3. Settings, then Accessibility. Turn off and remove any service you did not enable — scam apps rely on this permission to watch and control the screen.
4. Settings, then Apps, then Special app access, and review device admin apps and apps that can appear over others.
5. Settings, then Network, and check VPN; remove anything unfamiliar.
6. Open your Google Account security page and sign out devices you do not recognize.
7. Settings, then System, then Software update, and install anything pending.

If something is wrong: the exact order

Order matters. Changing your bank password while the intruder still has your email lets them reset it straight back.

1. Disconnect. Turn off Wi-Fi and mobile data, or switch on airplane mode, so nothing can be sent while you work.
2. From a different device — a spouse's phone, a laptop, a library computer — change your email password first. Email is the master key to everything else.
3. Turn on two-factor authentication for that email account.
4. Change your bank, payment app and Apple or Google account passwords, each different from the others.
5. Call your mobile carrier and ask for a port-out PIN or number-transfer lock, so nobody can move your number to their SIM.
6. Back on the phone, remove unfamiliar apps, profiles, VPNs and accessibility services, then install updates and restart.
7. Call your bank if any banking or payment app was on the phone, and ask them to watch for unusual transfers. Check for small test charges.
8. Report it: ReportFraud.ftc.gov, IC3.gov, and the National Elder Fraud Hotline at 833-372-8311 if the person is 60 or older.
9. Only if signs continue, back up your photos, then factory reset and set the phone up fresh, reinstalling apps by hand rather than restoring a full backup.

How hackers actually reach retirees' phones

Understanding the four real routes makes the defenses obvious.

1. The remote-support call

A pop-up or call claims your device is infected. You are walked through installing a screen-sharing app so a 'technician' can fix it. From that point they can see your banking, move money and open accounts. This is the most common route by a wide margin.

2. Phishing links in texts and emails

A delivery notice, a toll charge, a bank alert. The link opens a page that looks right and collects your login and the code that follows. Your phone is never touched; your account is taken.

3. SIM swapping

Someone convinces your carrier to move your number to their SIM, so your text codes arrive on their phone. The tell is your phone abruptly losing all service for no reason. A carrier port-out PIN blocks this.

4. Physical access

Someone who knows your passcode installs a tracking or monitoring app in a few minutes. Check profiles, accessibility services and device admin apps if anyone has had your unlocked phone.

Seven settings that keep a phone hard to hack

• Automatic updates on, for both the operating system and apps.
• A six-digit passcode or longer, plus Face ID or fingerprint — never 0000 or a birth year.
• Two-factor authentication on email, bank and Apple or Google accounts.
• A port-out PIN with your mobile carrier.
• Apps only from the App Store or Google Play, never from a link.
• Silence Unknown Callers (iPhone) or the equivalent call screening (Android), so scam calls never reach you.
• A trusted family member listed on the account who can help verify anything that feels urgent.

If your situation is not covered here, our free Scam Check tool will read the exact message you received and tell you whether it is a scam.