First, some good news
The iPhone is a hard phone to compromise. Most of the "hacks" we see are not a virus inside the system but something simpler: someone who knows your passcode, an Apple Account with a leaked password, a configuration profile installed through a trick, or a location shared without you noticing. The good news is that you can check all of that yourself in a few minutes.
Signs worth a closer look
None of these signs proves anything on its own. What matters is several appearing together or suddenly:
- The battery lasts much less or the phone gets warm when you are not using it.
- Mobile data use that does not match what you do (Settings > Mobile Data, at the bottom of the list).
- Apps you do not remember installing, especially with generic names.
- Sign-in alerts for your Apple Account from places or devices that are not yours.
- Messages or emails sent that you did not write.
- A threat notification from Apple. Apple warns by email, iMessage and in your account when it believes you have been targeted with the kind of spyware sold to governments. It is rare, but if you get one, take it seriously.
Five checks in Settings
1. Profiles and device management
Go to Settings > General > VPN & Device Management. If there is a profile or management (MDM) you do not recognise and the phone is not from your employer, that is the clearest sign of all: a profile can redirect your traffic or install certificates. Remove it.
2. Devices signed in to your Apple Account
Tap your name at the top of Settings and scroll down to the device list. Each of those devices can see your iCloud data. If one is not yours, remove it and change your account password.
3. Safety Check
In Settings > Privacy & Security > Safety Check you can see at a glance who you share your location, photos or notes with and which apps can access what. It was designed for exactly these situations and lets you cut everything off at once.
4. Shared location
Open the Find My app and check the People tab. Location sharing is the most common way people close to you keep tabs on you, and it needs no hacking at all.
5. Signs of a jailbreak
A jailbroken iPhone loses a large part of its protections and is the usual route for installing commercial stalkerware. If you see apps such as Cydia or Sileo, or your phone stopped updating for no reason, be suspicious.
What to do if something does not add up
- Update iOS to the latest version. Many vulnerabilities are closed that way.
- Change your Apple Account password from a trusted device and turn on two-factor authentication if it was off.
- Change your iPhone passcode to a six-digit or alphanumeric one nobody knows.
- Remove profiles, devices and apps you do not recognise.
- If the suspicion is strong, restore the iPhone as new, without restoring an old backup: the backup could bring the problem back.
- If you think you are being specifically targeted (journalists, lawyers, activists, executives), turn on iPhone Lockdown Mode and get specialist help.
If the problem comes from a partner or ex-partner, contact your local domestic violence helpline: digital control is a recognised form of abuse. Your national cybersecurity agency can also help you report the incident.
When a regular iPhone is not enough
If your work or situation makes you a target, it is worth starting from a phone prepared for it: iCloud disabled, USB port limited to charging, automatic wipe after several wrong PINs and a configuration reviewed by hand. That is what we do with our encrypted iPhones. And if you want the Android side of the problem, read how to tell if your phone is being spied on.
