{"id":1014,"date":"2026-06-25T15:24:00","date_gmt":"2026-06-25T15:24:00","guid":{"rendered":"https:\/\/spyapp.net\/blog\/?p=1014"},"modified":"2026-06-28T02:44:10","modified_gmt":"2026-06-28T02:44:10","slug":"is-my-phone-hacked-checklist","status":"publish","type":"post","link":"https:\/\/spyapp.net\/blog\/is-my-phone-hacked-checklist\/","title":{"rendered":"Is My Phone Hacked? A Step-by-Step Self-Diagnosis Checklist"},"content":{"rendered":"

“Is my phone hacked?” is usually asked in a moment of anxiety \u2014 a strange pop-up, a battery that died at lunch, a person who knew something they shouldn’t. Anxiety wants an answer, and the internet mostly offers either dismissal (“you’re paranoid”) or dread (“anyone can be hacked!”). This checklist offers neither. It’s a diagnostic: a fixed sequence of yes\/no checks, each pointing to a specific next step, that takes you from a feeling to a finding in about twenty minutes.<\/p>\n

\"Five-part<\/figure>\n

Work top to bottom. Stop and follow the branch whenever you hit a YES.<\/p>\n

Part 1: The two-minute triage<\/h2>\n

Check 1 \u2014 Is there an immediate, concrete problem?<\/strong> Money missing from accounts, texts you didn’t send appearing in your sent folder, password-reset emails you didn’t request, your contacts receiving strange messages from you?<\/p>\n

\u2192 YES:<\/strong> skip the diagnostics and act now: from a different device<\/em>, change the password of the affected account first, then your Google account, enable two-factor authentication, and contact your bank if money is involved. Then return here to find how it happened. \u2192 NO:<\/strong> continue \u2014 what follows is detection, not emergency response.<\/p>\n

Check 2 \u2014 Did anything specific just happen?<\/strong> A link you clicked, an APK you installed, someone who had your unlocked phone?<\/p>\n

\u2192 YES, an APK:<\/strong> that file is your prime suspect \u2014 scan it<\/a> now if you still have it, and continue below. \u2192 YES, physical access by someone you distrust:<\/strong> read the stalkerware guide<\/a> alongside this checklist; the safety notes matter. \u2192 NO:<\/strong> continue anyway \u2014 the checks below catch problems regardless of origin.<\/p>\n

Part 2: The lists that can’t lie (five minutes)<\/h2>\n

These three screens are where malicious apps must appear no matter how well they hide elsewhere.<\/p>\n

Check 3 \u2014 Settings \u2192 Accessibility \u2192 Downloaded apps.<\/strong> Is anything listed that you don’t recognize and didn’t deliberately enable? \u2192 YES:<\/strong> this is the strongest single finding. Note the exact name; don’t remove yet \u2014 go to Part 4. \u2192 NO:<\/strong> continue.<\/p>\n

Check 4 \u2014 Settings \u2192 Security \u2192 Device admin apps.<\/strong> Anything beyond Find My Device and known workplace tools? \u2192 YES:<\/strong> same as above \u2014 note it, Part 4. \u2192 NO:<\/strong> continue.<\/p>\n

Check 5 \u2014 Settings \u2192 Apps \u2192 See all apps.<\/strong> Scroll the full<\/em> list slowly. Any app you didn’t install, or generic system-sounding names (“Sync Service”, “Device Health”) sitting among your normal apps? \u2192 YES:<\/strong> open its App info; if it has surveillance permissions (SMS, microphone, location) or appeared in Checks 3\u20134, it’s a suspect \u2014 Part 4. \u2192 NO:<\/strong> continue.<\/p>\n

Part 3: The behavior checks (ten minutes)<\/h2>\n

Check 6 \u2014 Battery and data, at rest.<\/strong> In battery usage and data usage screens: significant background<\/em> consumption by unfamiliar apps, drain during hours the phone sat idle, a phone warm on the nightstand? \u2192 YES:<\/strong> the drain-diagnosis guide<\/a> tells spyware patterns from aging batteries; an app implicated there plus anything from Part 2 means Part 4. \u2192 NO:<\/strong> continue.<\/p>\n

Check 7 \u2014 Your accounts, from the other side.<\/strong> Google account \u2192 Security: unfamiliar devices signed in, security events you don’t recognize? Messaging apps \u2192 linked devices: web sessions you didn’t create? \u2192 YES:<\/strong> sign out everything unknown, change the Google password, enable 2FA \u2014 many “hacked phone” cases are actually this, a hacked account<\/em>, and you’ve just fixed it. Watch for a week. \u2192 NO:<\/strong> continue.<\/p>\n

Check 8 \u2014 The line itself.<\/strong> Dial #21#<\/em><\/code> and #62#<\/code>: any calls or texts forwarding to a number you don’t recognize? \u2192 YES:<\/strong> call your carrier from another phone, remove the forwarding, set a carrier PIN. \u2192 NO:<\/strong> continue to the verdict.<\/p>\n

Part 4: When you found something \u2014 confirm and remove<\/h2>\n

You have a named suspect from Checks 3\u20136. In order:<\/p>\n

    \n
  1. Verify before deleting.<\/strong> Export the app’s APK with a backup tool and upload it to our free APK scanner<\/a>. A SPYWARE verdict ends the doubt; the report also shows exactly what it could access \u2014 which tells you which passwords matter most in step 4.<\/li>\n
  2. Safety pause.<\/strong> If the likely installer is a partner, ex, or anyone whose reaction you fear: removal is visible to them. Talk to a support organization about timing first \u2014 the stalkerware guide<\/a> explains why this ordering can matter more than the removal itself.<\/li>\n
  3. Remove in the right order:<\/strong> revoke device admin \u2192 revoke Accessibility \u2192 uninstall (safe mode if it resists). Full walkthrough in the removal guide<\/a>.<\/li>\n
  4. Assume collected data is gone:<\/strong> from a clean device, change Google first, then banking and email; enable 2FA; audit sessions.<\/li>\n
  5. Re-run Parts 2\u20133<\/strong> to confirm the phone is clean, and close the door that was used \u2014 new PIN, unknown sources off, Play Protect on.<\/li>\n<\/ol>\n

    Part 5: When everything came back clean<\/h2>\n

    All eight checks negative is a meaningful result \u2014 you’ve just looked everywhere consumer-grade attacks actually live. Three honest possibilities remain:<\/p>\n