Signs Your Phone Is Being Monitored — and What They Mean

If you arrived here after a list of "ten signs your phone is tapped", start with this: almost every item on those lists also describes a phone that is three years old. Heat, battery drain, call noise and slowness are everyday symptoms of ageing hardware. Monitoring does happen and is worth checking — but a real check looks nothing like those lists.

[[answer]]Most repeated signs — heat, battery drain, call noise, slowness — have ordinary explanations. The diagnostic ones are specific: unknown configuration profiles on iPhone, apps with device-admin or accessibility rights on Android, unfamiliar account sessions, and data use you cannot match to an app.[[/answer]]

Why the familiar symptoms mean little

Each classic symptom has a mundane cause that is far more common. Lithium batteries lose capacity from day one, so by year two a phone that lasted until evening stops mid-afternoon. System updates add background work — photo indexing, search, cloud sync — that older processors handle with more heat and less speed.

Call noise deserves its own correction, because the folklore around it is specific and wrong. Mobile voice has been digital since GSM arrived in 1991: your speech is encoded by a codec before it ever leaves the handset. Early networks carried that digital stream over circuit-switched channels; only with LTE and 5G did voice move onto the packet network as VoLTE. Either way there is no analogue line to tap into and no physical splice to hear. Where lawful interception exists it is implemented at the operator's switching equipment, which produces no audible artefact on your end at all. The clicks, echoes and dropouts people notice are codec artefacts, handovers between cells, a loose headset or a case pressing on the microphone.

[[compare]] Symptom | Usual explanation | Worth a second look when Battery drains fast | Ageing cell, new OS version, weak signal | It changed overnight, with no update and no new app Phone runs hot | Charging, video, navigation, poor coverage | Hot while idle, screen off, nothing charging, for hours Noise on calls | Network conditions, handover, headset or case | Rarely on its own — call audio is a poor surveillance indicator [[/compare]]

What is actually diagnostic

Monitoring software has to survive reboots, stay out of the app drawer and read protected content. That requires privileges a normal app never asks for, and they are visible in settings.

• Configuration profiles or device management on iPhone. A profile can route traffic and install certificates. Employers use them legitimately; on a personal phone, one you did not install is a real finding.
• Device administrator and accessibility rights on Android. Accessibility exists so screen readers can read and act on screen content — exactly what a monitoring app wants. Device-admin rights make an app hard to uninstall.
• Unfamiliar sessions and linked devices in your accounts. Of the cases that turn out to be real, this is the category people run into most often, and it needs no software on the phone at all.
• Unexplained network traffic. Steady upload from an app you cannot identify matters; a warm case does not.

A shared password, or an old tablet still signed in on a shelf, is a more ordinary route into someone's messages than installed spyware. Nobody publishes reliable figures for either, so treat that as a working assumption rather than a statistic — but it is the first thing support specialists check, which is why [[post:someone-signed-into-my-account|checking who is signed into your accounts]] is usually the best place to start.

Checking an iPhone

Apple's model makes independent background software difficult, so the checks are short. Write down what you find before you change anything. Several of the steps below alter the device, and if you later need to show someone what was there, your notes and screenshots are all you will have.

[[steps]] Look for configuration profiles :: Settings, General, VPN and Device Management. On a personal phone this screen is usually empty, so a profile you did not add is one of the clearest findings available on iOS. Review your Apple Account devices :: Tap your name at the top of Settings and scroll the device list, removing anything you cannot place. Look at cellular data per app :: Settings, Cellular — the same screen is labelled Mobile Data in the UK and several other regions. Scroll for an unfamiliar name consuming a disproportionate amount. Update iOS :: Do this after the first three steps are recorded, not before. The current version closes most known exploitation routes, but installing it changes the device and can remove the very thing you were looking at. [[/steps]]

Apple's Personal Safety User Guide walks through the same profile screen, along with the rest of a device-and-account checkup, and is written for people who are not sure whether the phone is still only theirs.

Separately, Apple notifies people it believes have been targeted by mercenary spyware, and it uses three channels for the same alert rather than one: a banner at the top of account.apple.com after you sign in, an email, and an iMessage. Since April 2025 the email arrives from [email protected] — older notifications came from an @apple.com address — and the iMessage from [email protected]. Apple's notification never asks you to open a link, install anything or hand over a password, so a message that does is an impersonation of this process. The whole mechanism is documented in About Apple threat notifications and protecting against mercenary spyware. These alerts go to a small number of individually targeted people; never having received one is not a clean bill of health for an ordinary phone.

Checking an Android phone

Android is more open, so there is more to look at. Menu names vary between manufacturers, but every version has these entries.

[[steps]] Open device admin apps :: Settings, Security, Device admin apps. Legitimate entries are Find My Device and a work management app; anything else deserves an explanation. Read the accessibility list :: Settings, Accessibility, Downloaded apps. A generic name such as "System Service" or "Device Health" is a strong signal. Show all installed apps :: Settings, Apps, See all apps. Monitoring tools hide their icon but stay in this list, often under a system-sounding name. Scan with Play Protect :: Once the three lists above are written down, open the Play Store, tap your profile icon and run Play Protect. A scan can quarantine or remove what it finds, which is why it comes after the record and not before. Review account sessions :: Open your Google Account, go to the Security and sign-in section, find the "Your devices" panel and tap "Manage all devices". Sign out anything you cannot place, then change the account password from a different device. [[/steps]]

Google documents reviewing devices with account access and how Play Protect scanning works.

What these checks will not find

A clean result does not prove that nothing is happening, and that limit matters.

• Account access with valid credentials. If someone knows your password, nothing on the phone looks wrong. The evidence lives in login history.
• Network-level visibility. Whoever runs the Wi-Fi sees which servers you reach, though not encrypted content.
• Family and parental tools. Built into both platforms and visible only if you know where to look, which is why [[post:parental-control-on-the-internet|understanding how parental controls work]] is useful even for adults.
• Anything on a device you did not check. A laptop, a tablet or a smart speaker signed into the same account reads the same messages, and none of the steps above touch them.

If you do find something

Before deleting anything, consider your situation. If the likely source is someone who shares your home or has physical access to the phone, removing a monitoring app can notify them and escalate the risk. Plan first, and use a device that person cannot reach. This is a recognised problem with its own specialists: the Coalition Against Stalkerware maintains guidance and a directory of support organisations, the National Network to End Domestic Violence runs a Safety Net project devoted to exactly this technology, and in the United States the National Domestic Violence Hotline can talk through the safety planning before you change anything on the device. General hardening advice, such as the FTC's page on protecting your phone, is useful afterwards, but it does not cover the case where the other person is in the same house.

Otherwise the order is straightforward. Change your passwords from a different, trusted device — changing them on the affected phone hands the new one straight over. Turn on two-factor authentication, then revoke every session and linked device you do not recognise. Remove the profile or revoke the app's admin rights before uninstalling it, and update the system. For certainty, a factory reset with a fresh setup — not a restored backup, which can reinstall the same thing — is the most reliable way to know the device is clean.

[[faq]] Can I tell if my phone is tapped by dialling a short code? :: No. Those codes return call-forwarding settings from your carrier — useful for spotting diverted calls, but silent about software on the device. Does a fast-draining battery mean spyware? :: On its own, almost never. Capacity falls every year and updates add background work. Treat it as a prompt to check, not as evidence. Will antivirus find monitoring software? :: Sometimes on Android, where scanners detect commodity tools. On iPhone, apps cannot inspect other apps, so scanners there mostly check websites instead. Someone knows things only my phone could know. What now? :: Start with accounts, not the device. Review login history, change passwords from a separate machine and enable two-factor authentication. Do clicks or echoes on a call mean someone is listening? :: No. Mobile voice has been digitally encoded since the early 1990s, and interception happens in the operator's network, where it leaves no sound on your handset. [[/faq]]

The conclusion is undramatic. Most phones that feel watched are simply tired, and these checks come back clean. When they do not, the finding is usually concrete and fixable — a forgotten profile, an app with rights it never needed, an old session nobody signed out of. Either way you end with an answer instead of a suspicion.