Android Security

Was My Phone Compromised?

A checklist of what to look for if you suspect your Android phone has been tampered with, monitored, or hacked.

Note: Many symptoms — battery drain, odd behavior, high data usage — have completely innocent explanations. Look for clusters of suspicious signs, not any single one in isolation.

Signs in Settings

Developer Options
Go to Settings › About Phone and check if Developer Options is enabled — it shouldn't be for most users. If it is, check whether USB Debugging is on. That setting allows data extraction via a connected computer.
Device Admin Apps
Settings › Security › Device Admin Apps — only corporate MDM software or "Find My Device" should appear here. Any unknown app with admin rights is a red flag.
Accessibility Services
Settings › Accessibility › Installed Services — spyware commonly abuses accessibility permissions to read screen content and messages. Anything unrecognized here is suspicious.
Unknown Sources / Sideloading
Check Settings › Apps › Special App Access › Install Unknown Apps. If enabled for any app, it means apps can be installed outside the Play Store.

App & Permission Audits

Audit all installed apps
Go to Settings › Apps and show all apps including system apps. Look for anything with a generic or blank name, no icon, or an unfamiliar name.
Permission Manager
Settings › Privacy › Permission Manager — check which apps have access to Microphone, Camera, Contacts, SMS/Messages, and Location. Revoke anything that looks wrong.
Overlay permission
Look for apps with "Draw Over Other Apps" permission — a common spyware vector that lets an app layer a fake UI over everything else you see.

Network & Data Behavior

Data usage
Settings › Network › Data Usage, sorted by highest usage. A hidden app sending data will show up here even if it's invisible on the home screen.
Battery usage
Settings › Battery › Battery Usage — spyware running in the background often drains the battery and will appear in this list even when it's otherwise hidden.
Network monitor
If possible, install a network monitor app (such as NetGuard) to see which apps are making outbound connections in real time.

Google Account Security

Check connected devices
Go to myaccount.google.com › Security › Your Devices and review for any unrecognized devices logged into your account.
Third-party app access
On the same Security page, check Third-party apps with account access for anything suspicious or unrecognized.
Recent security activity
Review your recent security activity for unfamiliar logins or locations — signs that someone else has accessed your account.

Physical & Carrier-Level Checks

SIM swapping
SIM swapping is a real attack. Contact your carrier directly — in person or via a trusted number — to check if the SIM or account has been modified, or if call forwarding has been set up.
Call forwarding in the Phone app
Open the Phone app, go to Settings › Calls › Call Forwarding. It should be disabled.
Carrier codes
Dial *#21# to check if unconditional call/message forwarding is active.
Dial *#62# to check forwarding when your phone is unreachable.

Google Play Protect

Open the Play Store, tap your profile icon, then tap Play Protect. Make sure it's enabled and run a scan. It can detect known stalkerware and malicious apps.

Nuclear Option

If anything suspicious is found — or even if nothing is found but the concern remains strong — the most reliable fix is a full factory reset followed by carefully restoring only trusted apps. Do not restore from a full backup, as it could re-introduce the problem.