8 Signs Your Phone Has Been Hacked (and What to Do)

The clearest signs your phone has been hacked are fast battery drain, unexplained spikes in data usage, apps you don't remember installing, pop-up ads outside your browser, and calls or texts sent from your number that you didn't send. One of these alone might have an innocent explanation, but two or more together, especially alongside password-reset emails or multi-factor authentication (MFA) codes you didn't request, is a strong signal that your device or an account tied to it has been compromised.

Phone compromise usually falls into one of three categories: malware running on the device itself, a SIM swap where a criminal convinces your mobile carrier to move your phone number to a SIM card they control, or stalkerware, commercial monitoring software installed by someone with brief physical access to your phone. Knowing the full list of warning signs matters more than watching for just one.

8 Common Signs of a Hacked Phone

Most phone compromises show up as small performance changes before anything dramatic happens. Watch for:

• Battery drains faster than normal. Malware or spyware running in the background keeps the processor active even when you're not using the phone.
• Data usage spikes. Malicious apps often send data to remote servers, which shows up as usage you can't account for in your carrier's data dashboard.
• The phone runs hot when idle. Sustained background processing generates heat even when the screen is off.
• Unfamiliar apps appear. You find an app you don't recall downloading, sometimes with a generic name or blank icon.
• Pop-up ads appear outside your browser. Legitimate apps don't generate ads on your home screen or lock screen; this usually points to adware or a malicious app.
• Performance slows or apps crash. Malware competing for memory and processing power can make a phone that used to run fine feel sluggish.
• Calls, texts, or emails you didn't send. Contacts report messages from you that you never wrote, often containing links.
• Settings change on their own. New accessibility permissions, VPN configurations, or a device administrator profile appear without your input.

None of these signs is proof on its own; an aging battery or a background update can look similar. What matters is whether the pattern is new and whether more than one sign shows up around the same time.

Signs That Point to Account Takeover, Not Just Malware

Some warning signs mean an attacker already has access to your accounts, not just your device. These require faster action:

• Password-reset emails you didn't request. Someone is attempting to take over an account tied to your phone number or email.
• MFA codes arrive when you're not logging in. This means someone already has your password and is trying to complete the second factor.
• Your phone suddenly loses all service. No calls, texts, or data, with no carrier outage in your area, can indicate a SIM swap, where a criminal has ported your number to a new SIM card to intercept calls and text-based verification codes. See our guide to SIM swap attacks for how to lock down your carrier account.
• You're locked out of accounts you didn't try to log into. The attacker changed the password after gaining access.
• Unfamiliar login locations appear in account activity logs. Check the recent-activity or sign-in-history section of your email, banking, and social media accounts.

How Phones Get Hacked in the First Place

Most phone compromises trace back to one of a handful of methods, and understanding them helps you close the gap that let the attacker in:

• Phishing links in text messages (sometimes called smishing) or email that install malware or steal login credentials when tapped. See our guide on how to spot a smishing text message scam.
• Malicious or sideloaded apps, particularly ones installed outside the official App Store or Google Play, that request excessive permissions.
• Unsecured public Wi-Fi, where an attacker on the same network can intercept unencrypted traffic. Our VPN security guide covers how to protect yourself on public networks.
• SIM swap fraud, where a criminal uses stolen personal information to convince your carrier to activate your number on a new SIM card.
• Stalkerware, commercial apps installed with brief physical access to an unlocked phone, often by someone the victim knows.

The Cybersecurity and Infrastructure Security Agency (CISA), the federal agency responsible for national cybersecurity guidance, recommends keeping phone operating systems and apps updated, since attackers frequently exploit known, already-patched vulnerabilities. According to Verizon's Data Breach Investigations Report, stolen or reused credentials remain among the most common ways attackers gain initial account access, which is why a phone compromise so often leads directly to account takeover rather than staying contained to the device.