My Phone Has Been Hacked: What to Do (and How to Tell If It Really Is)

If you think your phone has been hacked, first check the realistic signs: apps or profiles you didn’t install, accounts signed in from devices you don’t own, or a sudden loss of mobile service. Then update the operating system, remove unknown apps and device-management profiles, change your important passwords from a device you trust, turn on two-step verification, and ask your carrier for SIM-swap and port-out protection. If problems continue, back up your photos and files and factory reset the phone as a last resort.

Many things that feel like hacking aren’t. Many that are hacking don’t look like anything at all. This guide separates the two, then gives you a practical order to work in.

Signs your phone may really be hacked

Modern iPhones and Android phones are hard to hack remotely. Most “phone hacks” are really one of three things: a malicious app you were tricked into installing, someone with physical access installing monitoring software, or an attacker taking over your phone number or your accounts rather than the phone itself. These signs are worth taking seriously:

• Apps you didn’t install, especially ones with generic names or no icon, or apps with access to accessibility, device admin or notification settings you didn’t grant.
• A configuration or device-management profile you don’t recognize, on a phone that isn’t managed by an employer or school.
• Your phone suddenly shows “No service” or “SOS only” in a place where it normally works, and your number stops receiving calls and texts. This can mean your number was moved to another SIM.
• Verification codes or password reset messages arriving for accounts you didn’t try to sign in to.
• Accounts signed in on devices you don’t own, visible in your Apple Account, Google Account or messaging app settings.
• Messages or posts sent from your accounts that you didn’t write.
• Someone knows things they shouldn’t, like your location, private messages or photos, particularly an ex-partner or someone close to you.

Common myths: things that usually aren’t hacking

What you notice	What it usually is
Battery drains faster than before	An aging battery, a recent update, or an app using location or background data. Check battery usage in settings; an unknown app high on the list is the real warning sign.
Pop-ups saying “your phone is infected”	A website ad or browser notification, not a virus. Close the tab and don’t call any number shown.
Strange calendar events or notifications	A website you allowed to send notifications, or a spam calendar subscription. Remove it in settings.
Clicks or echoes on calls	Network or line quality. Calls are not normally tapped this way.
The phone gets warm	Charging, heavy apps, hot weather or poor signal.
An email saying a hacker recorded you	Almost always a mass extortion scam, explained in our guide on the “you’ve been hacked” email.

None of these rules out a problem on its own. They just aren’t strong evidence. Look for the signs in the first list instead. Tapping a link in a scam text, such as a fake USPS delivery notice or unpaid toll message, usually leads to a page that tries to steal your card details or login rather than hacking the phone itself.

Step by step: what to do if your phone is hacked

1. Update the operating system. Install the latest iOS or Android update, and update your apps. Updates close the security holes most attacks rely on.
2. Remove apps you don’t recognize. Go through the full app list, not just the home screen. On Android, also check which apps have device admin, accessibility or notification access, and remove those rights from anything unfamiliar before uninstalling it. Run Google Play Protect’s scan.
3. Remove unknown profiles. On iPhone, check the VPN and device management section of settings. On Android, check device admin apps and any work profile. Remove anything you didn’t install, unless your employer manages the phone, in which case ask your IT team.
4. Check your main account’s devices. In your Apple Account or Google Account, review signed-in devices and remove any you don’t own. Check that your recovery email and phone number are yours.
5. Change passwords from a trusted device. Start with your email, your Apple or Google account, banking and any account holding payment details. If you suspect the phone itself is compromised, use a different device for this step.
6. Turn on two-step verification or passkeys everywhere you can. Prefer an authenticator app, passkey or security key over text-message codes.
7. Sign out other sessions in email, social media and messaging apps, and check linked devices in apps like WhatsApp and Signal.
8. Protect your number with your carrier, as described in the next section.

If the signs point to one hacked account rather than the whole phone, work on that account. For example, if your first thought is “my Instagram has been hacked” and nothing else looks wrong, follow our Instagram recovery guide. When the thought is simply “my account has been hacked” and you’re not sure which, our general hacked account checklist helps you find the starting point.

Protect your number: SIM swaps and port-out fraud

In a SIM swap, an attacker convinces your carrier to move your number to a SIM card they control. In a port-out scam, they move your number to a different carrier. Either way, your calls and text codes go to them, and they can reset accounts that use your number for verification. Your phone itself isn’t hacked, but the effect is similar.

Major US carriers offer protections you can turn on through your account online, in their app or in a store:

• An account PIN or passcode that’s required before changes are made. Use one that isn’t your birthday or the last digits of your number.
• SIM-swap or number-lock protection, which blocks SIM changes unless you turn it off first.
• Port-out protection, which blocks transfers to another carrier without extra verification.

If your phone suddenly loses service and you didn’t change anything, contact your carrier right away from another phone, using the number on its official website. Ask whether a SIM change or port-out was made on your account, and have them reverse it and lock the account.

It also helps to reduce how easy your number is to find. Our guide on removing your phone number from the internet covers data brokers and people-search sites.

Factory reset: the last resort

A factory reset erases the phone and reinstalls the operating system. It removes almost all malicious apps and profiles. It’s the right step if you’ve done everything above and still see signs of compromise, or if you can’t identify what’s wrong.

1. Back up what matters: photos, documents, messages and contacts. Be selective. Restoring a full device backup can bring back the same settings or apps.
2. Know your account passwords and two-step codes before you reset, so you can sign back in.
3. Reset through the phone’s settings.
4. Set the phone up fresh and reinstall apps one at a time from the official app store, rather than restoring everything at once.
5. Change your main account passwords again once the phone is clean.

If you’re a journalist, activist, executive or public figure and worry about targeted spyware, turn on Lockdown Mode on iPhone or Android’s advanced protection features, keep the phone updated, and consider professional security help. These tools reduce what an attacker can exploit.

If your personal data was misused

A compromised phone can expose messages, photos, contacts and saved logins. If someone uses your information to open accounts, make purchases or impersonate you, report it at IdentityTheft.gov, the FTC’s official site, which creates a recovery plan. Consider a free credit freeze with the three major credit bureaus. Our guide on what to do if your identity is stolen covers the full set of steps.

A worked example

This scenario is illustrative, not a real client. Jordan’s phone shows “SOS only” at home one evening. An hour later, she gets an email saying her email password was changed.

1. She borrows her partner’s phone and calls her carrier using the number on its website. The carrier confirms a SIM change was made that afternoon. They reverse it, and she sets an account PIN and turns on SIM-swap and port-out protection.
2. From her laptop, she uses her email provider’s recovery process and gets back in. She changes the password, removes a forwarding rule and switches two-step verification from text codes to an authenticator app.
3. She checks her bank and PayPal, changes both passwords and reports one transfer she didn’t make to her bank.
4. Her phone itself shows no unknown apps or profiles, so she updates it and doesn’t need a factory reset.

Nothing was installed on her phone. The attack went through her carrier account, which is why carrier protection was the fix.

Common mistakes

• Installing a “cleaner” or “antivirus” app from a pop-up. Pop-up warnings are ads, and some of those apps are the problem.
• Changing passwords on a phone you think is compromised. Use a trusted device.
• Ignoring the carrier. Many takeovers happen through your number, not your handset.
• Restoring a full backup straight after a reset. Reinstall apps fresh instead.
• Paying a phone “recovery service” or “hacker for hire.” These are scams. Use your phone maker’s, carrier’s and account providers’ official help routes.

If a hacked phone led to private photos or messages being shared, or posts in your name spreading online, our personal reputation management team can help with removal requests and cleanup.

Frequently asked questions

Can someone hack my phone just by calling or texting me?

It’s rare for ordinary people. Such attacks exist but are expensive and usually aimed at high-profile targets. Most people are compromised through phishing links, malicious apps, account takeovers or SIM swaps. Keeping your phone updated closes most of the holes.

Will a factory reset remove a hacker?

It removes almost all malicious apps and profiles on the phone. It won’t fix hacked accounts or a SIM swap, so change your passwords, turn on two-step verification and lock down your carrier account as well.

How do I know if my phone has spyware?

Look for apps you didn’t install, apps with accessibility or device admin access you didn’t grant, unknown management profiles, and signs that someone knows your messages or location. If you think someone close to you installed it, get safety advice before removing it.

Should I get a new phone number after being hacked?

Usually not. Locking your carrier account with a PIN and SIM-swap and port-out protection is normally enough. A new number is worth considering if you’re being harassed or the number is widely exposed.