Warning signs on your smartphone
Phone spying is not a movie plot. Every day, thousands of people find out their devices were compromised without their knowledge. The good news is that your phone leaves you clues when something is wrong. Reading them correctly is the first step to protecting your privacy. If you suspect physical surveillance as well as digital — hidden microphones or cameras in your home or office — our TSCM sweep service is built for exactly those cases.
The first sign that should get your attention is unusual battery drain. If your phone goes from lasting all day to needing a charge by mid-afternoon and nothing about your habits has changed, something is consuming resources in the background. Spy software — known as stalkerware or spyware — has to run constantly to capture your location, read your messages or record your calls. That continuous work has an obvious energy cost.
Unexplained overheating is another clear indicator. When you are not gaming or running heavy apps, but the device heats up as though you were rendering 4K video, hidden processes are at work. Touch the back of your phone while it is idle: if it is hot for no apparent reason, pay attention.
Battery and data: the first indicators
Mobile data usage is perhaps the easiest clue to track. Spyware has to send the information it steals to an external server, and that eats into your data plan. Check your monthly usage in your carrier's app or in system settings. Unexplained spikes, or usage well above your normal level, can mean someone is pulling information off your device.
On Android, go to Settings > Network & internet > Data usage. On iOS, Settings > Mobile Data. Look for apps consuming a disproportionate amount of data. If an app you barely use is your biggest consumer, uninstall it immediately. System apps you do not recognise also deserve a closer look.
Erratic phone behaviour is revealing too: the screen turns on by itself, the phone freezes or reboots for no reason, apps take longer than usual to open. Taken individually, these micro-symptoms can look like ordinary system glitches. Together they form a pattern that points to an intrusion. Surveillance software injects itself into system processes and causes instability.
Strange noises during calls
Have you noticed beeps, clicks or echoes during phone conversations that were not there before? Interference can come from poor coverage, but if it is persistent and happens in places where you used to have a good signal, it can indicate your calls are being intercepted or recorded. Some spyware works like a silent third party on the line, and its presence produces detectable audio artefacts.
Odd SMS messages with random characters or meaningless symbols are another warning sign. Many surveillance trojans receive commands through encoded SMS. If your inbox shows messages that do not look meant for a human, do not ignore them: they are instructions for malicious software living on your device.
Apps you do not remember installing
Go through the full list of apps installed on your phone. Both Android and iOS let you see every app, including system ones. If you find something you do not recognise — especially apps with generic names like "System Update", "Device Service" or "Wi-Fi Helper" — investigate before deleting them. A quick Google search of the app name usually reveals whether it is legitimate.
On Android, pay particular attention to apps with accessibility permissions. This permission, designed to help people with disabilities, is the most powerful in the system: it lets an app read your screen contents, simulate taps and monitor everything you do. Stalkerware abuses it systematically. Go to Settings > Accessibility > Installed services and review which apps have access. If you see anything suspicious, revoke the permission immediately.
What to do if you detect an intrusion
If you have identified several of these signs, stay calm. First and most important: do not confront the person you suspect is monitoring you if it is someone close to you. Stalkerware is usually installed by a partner, a family member or someone with physical access to your device. Confronting that person can escalate a situation that is already delicate.
The next step is to change all your passwords from another device you know is clean. Email, social media, online banking: all of it. If the attacker has had access to your phone for weeks, assume they know every password you have typed. Turn on two-step verification everywhere it is offered.
For the technical fix, you have two routes. The one we recommend is a factory reset: wipe the device completely and set it up as new. Do not restore backups, since they could contain the spyware. The second route, if you want to keep your data, is to go to a cybersecurity professional who can identify and remove the malicious software surgically.
If the situation involves gender-based violence or harassment, seek specialist help. In Spain, 016 is the helpline for victims of gender-based violence, available 24 hours a day, and it leaves no trace on your phone bill. Organisations such as INCIBE also offer free cybersecurity assistance to the public.
Remember: an encrypted phone with an encrypted operating system such as GrapheneOS removes the vast majority of these attack vectors from day one. Prevention is always cheaper — in every sense — than the cure. Take a look at our encrypted device store if you want to make the move.
