How to tell if your phone is hacked: signs and what to do

How do I know if my phone is hacked? The signs

In practice, a hacked phone usually means a phone with a malicious app installed or a taken-over account (Google, Apple, a messenger). According to CERT Polska, the Polish national CSIRT, mobile malware arrives mainly through apps installed from a link, a website or a pirated copy, and less often through an unpatched system flaw.

Signs worth checking:

1. An app you did not install, or an icon that disappeared right after installation.

2. Unknown charges on your phone bill, texts from short codes, subscriptions you never ordered.

3. Ads popping up outside the browser, new home pages, notifications from unknown sites.

4. Alerts about sign-ins to your accounts from a new device, a changed password, messages sent from your account to friends.

5. Someone knows things they should not: where you have been, who you talk to. The Coalition Against Stalkerware names this as the most common sign that someone is monitoring your phone.

A fast-draining battery, heat and slowness usually have ordinary causes, such as an old battery or a heavy app. On their own they prove nothing.

Codes to check if your phone is hacked: what they really do

Lists of "hacked phone codes" circulate online. They are codes defined in the 3GPP TS 22.030 standard. The call forwarding codes are mobile network supplementary service commands: they work the same on iPhone and Android because they go to the operator, not to the phone's system. None of them detects viruses or spyware.

1. *#21# checks whether unconditional call forwarding is on (all calls go to another number).

2. *#67# checks forwarding when busy, *#62# when unreachable, *#61# when you do not answer.

3. ##002# erases all call forwarding, including forwarding to voicemail. If you use voicemail, turn it back on afterwards following your operator's instructions.

4. *#06# shows the phone's IMEI. This code is handled by the phone itself, not the operator. Useful when reporting a theft, not for finding malware.

Forwarding to your operator's voicemail number is normal. An unknown number is a warning sign: dial ##002#, call your operator and ask who enabled forwarding and when. Someone with forwarding can receive your calls, including verification calls from your bank.

How to check if your iPhone is hacked

1. Update iOS: Settings, General, Software Update. CERT Polska notes that high-profile zero-click attacks, such as Pegasus via iMessage, used flaws Apple has since patched (iOS 14.8).

2. Check profiles: Settings, General, VPN and Device Management. Apple says that if you see nothing there, no management profiles are installed. Remove an unknown profile your employer or school did not install. On a work phone, ask the administrator first.

3. Run Safety Check (iOS 16 and later): Settings, Privacy and Security, Safety Check. You will see who you share location and data with and which devices are signed in to your Apple Account, and you can revoke access right away.

4. Review the device list in your Apple Account settings and change your password if you see an unknown device.

5. Look for apps you do not recognise and review location, microphone and camera permissions (Settings, Privacy and Security).

CERT Polska says a classic antivirus on iPhone has little value, because it runs in a sandbox and cannot see other apps. For people at particular risk of expensive targeted spyware, Apple offers Lockdown Mode, described in its Personal Safety guide.

How to check if an Android phone (such as a Samsung) is hacked

Menu names differ between manufacturers, Samsung included, but every Android phone has these places:

1. Play Protect: Google Play Store, profile icon, Play Protect. Run a scan and check that app scanning is on. Google says Play Protect also checks apps from outside the store and can disable or remove them.

2. App list: Settings, Apps. Look for apps with no name, a generic name such as "System update", or that you never installed.

3. Special permissions. CERT Polska warns about three in particular: Accessibility (the app can read the screen and tap for you), Notification access (it reads notification content, including codes) and SMS access. Revoke them from any app that does not need them for its job.

4. Device admin apps: usually in Settings under security. Such an app can lock the screen, enforce a password and even wipe data. If you do not know why an app has this role, remove it. Only then can the app be uninstalled.

5. Safe mode. Google's help suggests restarting in safe mode. If the problem goes away, remove recently installed apps one by one.

6. Your phone bill and paid services. Ask your operator to block premium SMS and carrier billing if you do not use them.

Also check whether the phone still gets security updates. CERT Polska recommends considering a replacement for a phone that no longer does, especially if you use it for banking.

How to remove a virus from your phone for free

You do not need a paid app. Do this in order:

1. Update the system and apps.

2. On Android, run a Play Protect scan.

3. Uninstall the suspicious app. If the uninstall button is greyed out, first revoke its device admin and Accessibility permissions.

4. From another, trusted device, change the passwords for your email, Google or Apple account and bank, sign out unknown sessions and turn on two-step verification. For next steps with taken-over accounts, see someone hacked my account: what to do.

5. If symptoms persist, factory reset. On Android, do it in Settings, and make sure you know your Google account password before the reset. On iPhone: Settings, General, Transfer or Reset iPhone, Erase All Content and Settings. After the reset, install apps from the store, not from files.

6. If you lost money, call your bank immediately. In Poland, forward suspicious texts to 8080, the CERT Polska reporting number.

Beware of "your phone has a virus" messages on websites and in ads. They usually push you to install an app, and CERT Polska specifically warns about fake updates and "video players". According to CERT Polska, simply tapping a link usually does not infect a phone; entering data or manually installing an app does. You can check a link for free before opening it, and general rules are in how to check if an app is safe.

Stalkerware: someone is watching me through my phone

Stalkerware is an app or device that lets one person secretly track another through their phone: location, messages, photos, calls. It is usually installed by someone close who had physical access to the phone.

If you suspect stalkerware, do not remove it straight away. The Coalition Against Stalkerware warns that removal may be noticed by the abuser and escalate the abuse, and it also destroys evidence. First, from another device, contact a support organisation or the police and make a safety plan. If your life is in danger, call 112.

How to check for a virus on a computer or laptop

On Windows the built-in tool is Windows Security. According to Microsoft, you start a scan under Virus and threat protection: quick, full, or a Microsoft Defender Offline scan, which runs after a restart without loading Windows and deals with persistent malware.

The rules are the same as on a phone: updates, software only from known sources, password changes from a clean device and, if nothing helps, reinstalling the system.