Key takeaways
- Law enforcement wiretaps happen at the carrier level and leave no signs on your phone. For most people, the real risk is spyware or stalkerware installed on the device, or someone with access to their Apple or Google account.
- Common warning signs include strange noises during calls, a battery that drains or overheats quickly, spikes in data usage, apps you don’t recognize, and camera or microphone indicators turning on unexpectedly.
- Codes like *#21# and *#62# only show whether your calls are being forwarded. They can’t detect spyware.
- To check for surveillance, review app permissions, watch the privacy indicators on iPhone or the Privacy Dashboard on Android, check which devices and people can access your accounts, and scan your phone with a mobile security app.
- If your phone is compromised, switch to airplane mode, remove suspicious apps, and use a factory reset as a last resort. If you suspect someone you know installed stalkerware, speak to a domestic violence advocate before making changes.
How to know if your phone is tapped: 11 warning signs
The most common signs that your phone is tapped or tracked are strange noises during calls, a battery that drains or overheats quickly, unexplained spikes in data usage, apps you don’t recognize, and camera or microphone indicators that light up when you aren’t using them. Any one of these can have an innocent explanation, but several together are worth investigating.
1. Strange sounds during calls
Hearing clicking, static, or faint voices in the background of calls could suggest interference from spyware. Occasional static is usually due to a weak signal or network issues, but persistent noises that weren’t there before should be treated as a red flag. Some forms of surveillance tech can even introduce subtle echoes or small delays in conversation.
2. A hot, slow, or quickly draining phone
Lots of apps drain battery, but a phone that suddenly overheats or loses charge much faster than usual could have spyware running in the background. Surveillance apps continuously send data, which uses more power and processing (CPU), so your phone may also start to lag or freeze. Older batteries degrade naturally, but a sudden change in battery life or performance could mean your phone is being used for more than just personal communication.
3. Unusual activity when you’re not using your phone
Does your phone seem to have a mind of its own? If it restarts unexpectedly, sets off alerts, or lights up when you don’t expect it, these can all be warning signs.
Spyware or hacking attempts could force your phone to execute commands remotely. Malicious software can also trigger strange pop-ups or cause apps to open on their own. Any of these is worth a closer look.
4. Trouble shutting down
When shutting down takes longer than usual or your phone freezes before turning off, it could be a sign that it’s sending data before it powers off. Surveillance apps sometimes try to complete background tasks or maintain access.
5. Websites that look different
Spyware and tracking software can modify how websites appear. This is most noticeable on login and payment pages. If websites seem off, with things like incorrect logos or weird pop-ups, then malicious software might be intercepting data. Avoid entering passwords or payment details until you’ve checked your phone.
6. Unusual text messages
Receiving random text messages with strange characters or symbols could mean a spyware app is using SMS commands. Some spyware tools communicate with external servers using coded text messages that aren’t meant to be understood by the user.
7. Cameras and microphones turning on by themselves
If the camera light turns on or microphone indicators appear without reason, unauthorized software could be accessing these features. A phone that suddenly starts recording audio or video without input could be compromised.
8. Increased data usage
Spyware or tracking software sends data to third parties, often without you realizing it. An unexpected spike in mobile data usage might mean your phone is secretly transmitting information. Checking your data usage in Settings can help identify which apps are responsible.
9. Hidden or suspicious apps
Malicious software often disguises itself as an ordinary app. If an unfamiliar app appears on your phone or an app requests permissions it doesn’t need, it could be a sign of spyware. Checking app permissions and installation history can help identify anything suspicious.
10. Status icons appearing unexpectedly
Some phones display icons when features like the camera or location services are in use. If these indicators appear when an app isn’t open, it might mean a background process is accessing sensitive information.
This feature is useful for detecting unauthorized surveillance, but there can sometimes be innocent explanations (such as if you have allowed an app to access your location).
11. Unfamiliar profiles or device admin apps
Some surveillance tools give themselves extra control over your phone by installing a configuration profile (on iPhone) or registering as a device admin app (on Android). This lets them change settings and makes them harder to remove. On iPhone, check Settings > General > VPN & Device Management. On Android, search Settings for “device admin apps.” If you see something you don’t recognize and your phone isn’t managed by an employer or school, treat it as suspicious.
How to check if your phone is tapped or tracked
Suspecting surveillance is one thing, but confirming it requires further investigation. Here are some ways to check whether your phone has been compromised.
Check for call forwarding
Phone tapping sometimes involves call forwarding, where incoming calls are silently redirected to another number. On most GSM networks, dialing *#21# shows whether all calls are being forwarded, and *#62# shows where calls go when your phone is unreachable. You can also check your call settings. These codes only reveal call forwarding, not spyware, and they don’t work on every carrier.
Turn off call forwarding
If call forwarding is active and you don’t know why, that is a cause for concern. You can turn it off in your phone’s settings. On most GSM networks, dialing ##002# also cancels all call forwarding at once.
Turn off call forwarding on iPhone
- Open Settings.
- Go to Apps > Phone > Call Forwarding (on older versions of iOS, go to Phone > Call Forwarding).
- If enabled, toggle it off.
Turn off call forwarding on Android
- Open the Phone app.
- Tap the menu (three dots) and select Settings.
- Go to Call Forwarding and turn off any active forwarding. On some devices, this is under Calling accounts or Supplementary services.
Check your Apple or Google account
Someone doesn’t always need spyware to track you. If they know your Apple ID or Google login, or you’ve shared your location with them in the past, they may be able to see where you are, along with your photos, messages, and other data that syncs to the cloud. This is one of the most common ways people are tracked, especially by someone they know.
Check your account on iPhone
- Go to Settings and tap your name. Scroll down to see every device signed in to your Apple ID, and remove any you don’t recognize.
- Open the Find My app and tap People to see who you’re sharing your location with.
- On iOS 16 and later, use Safety Check (Settings > Privacy & Security > Safety Check) to review and stop sharing with people and apps in one place.
Check your account on Android
- Go to your Google Account, then Security > Your devices, and sign out of any device you don’t recognize.
- In Google Maps, tap your profile picture and select Location sharing to see who can view your location.
If you find a device or person you don’t recognize, change your password and turn on two-factor authentication. If you think the person is someone you know, read the safety note in the What to do if your phone has been tapped section first.
Check for unknown trackers like AirTags
Bluetooth trackers such as AirTags can be slipped into a bag, coat, or car. iPhones show an alert if an unknown AirTag appears to be traveling with you. Android phones can also alert you, and you can run a manual scan under Settings > Safety & emergency > Unknown tracker alerts. If you find a tracker, the alert will help you play a sound to locate it.
Check for spyware or malware
Reviewing installed apps can help detect unauthorized software. Security apps or antivirus programs can scan for known spyware and alert you if there is anything untoward on your device. If your phone has been jailbroken or rooted without your permission, this can increase the risk of surveillance tools being installed.
Malicious apps don’t only come from shady websites. In 2025, a form of malware called SparkCat managed to infiltrate phones via apps available on the App Store and Google Play Store. These apps were downloaded hundreds of thousands of times and scanned users’ photo galleries for screenshots of crypto wallet recovery phrases, which could be used to access crypto accounts.
Monitor app permissions
It can be annoying when apps constantly ask for permissions. Sometimes people just allow them for convenience, but knowing which apps have access to functions like the microphone and location is crucial. Apps should only have permissions relevant to their function. If a shopping app or calculator suddenly requests microphone access, it’s a cause for concern.
Check tracking indicators on iPhone
Apple’s iOS displays a green dot when the camera is active and an orange dot when the microphone is in use. The location services arrow appears when an app is tracking movement. Opening Control Center shows which app most recently used the camera or microphone. These privacy indicators help identify potential surveillance and apps that may be accessing these features unnecessarily.
Check tracking indicators on Android
Android’s Privacy Dashboard (available on Android 12 and later) logs apps that access the camera, microphone, and location. Reviewing this log can reveal suspicious activity and show which apps have recently used these features.
How to reduce the risk of having your phone tapped
A few simple steps make it much harder for anyone to access your phone or install spyware on it.
Keep your phone updated
Regular software updates are essential for keeping a phone secure. Manufacturers frequently release security patches to fix vulnerabilities that hackers or spyware might exploit.
Many people update for new features, but updates also close security gaps. Skipping them leaves your phone exposed to known flaws that attackers can use to install tracking software or intercept communications.
Use secure communication apps
End-to-end encrypted messaging apps provide a layer of protection against interception. Unlike standard SMS, which can be vulnerable to hacking or surveillance, encrypted apps ensure that only the sender and recipient can read messages.
Popular secure messaging services prevent even the app developers from accessing conversations, which can make them an essential tool for private communication. Keep in mind that encryption protects messages in transit, so it won’t help if spyware is already installed on the phone itself.
Use a VPN
A Virtual Private Network (VPN) encrypts your internet traffic, which makes it harder for hackers and third parties to track online activity.
A VPN masks your IP address and browsing activity and helps protect against unwanted surveillance. Without a VPN, the data you send (particularly over public Wi-Fi networks) could potentially be intercepted, allowing attackers to collect sensitive information. Like encrypted messaging, a VPN won’t help if spyware is already installed on your phone.
Turn off Bluetooth
Leaving Bluetooth enabled allows nearby devices to attempt connections, creating potential security risks. Attackers can use Bluetooth vulnerabilities to gain access to a device or install spyware. Keeping Bluetooth off when not in use minimizes the risk of unauthorized tracking or hacking.
Manage app permissions
Many apps request access to data they don’t actually need. Review your permissions regularly using the iPhone and Android steps above, and revoke anything an app doesn’t need to work.
Delete unused or suspicious apps
Uninstalling apps that are no longer in use or seem suspicious reduces the attack surface of a device. Malicious apps often disguise themselves as harmless software but can run surveillance operations in the background.
Phishing attacks can nudge people to download malicious apps. A regular review of installed applications helps eliminate security threats before they become a problem. Unwanted apps can give hackers control over your device and access to your personal data.
Clear your cookies and cache
Web browsers store cookies and cached data that can be used to track your browsing habits. Clearing them removes cookie-based tracking and anything left behind by compromised websites. The trade-off is that you’ll be signed out of sites and need to reset some preferences.
Use a private browser
Standard web browsers collect large amounts of user data through trackers and cookies. A private browser can limit how websites monitor browsing habits and minimize exposure to data collection and targeted surveillance.
Install Malwarebytes mobile security software
Security apps help detect and block spyware and other malicious software. The Malwarebytes mobile security app offers real-time protection and alerts you about any suspicious activity so that you can take action. Malwarebytes mobile security now includes an AI-powered Scam Guard feature that offers real-time scam detection, so you can recognize suspicious links right away.
What to do if your phone has been tapped
If you are worried that your phone has been tapped or compromised, then you’ll need to take immediate action to stop further data leaks. The following steps can help regain control.
Important: If you think someone you know, such as a current or former partner, installed stalkerware on your phone or has access to your accounts, be aware that removing it or changing your passwords may alert them. Consider contacting a domestic violence advocate to plan your next steps safely before you make changes to the device.
Put your phone into airplane mode
Enabling airplane mode instantly disconnects a device from all wireless networks. It can be a quick way to prevent hackers or surveillance software from accessing data in real time. While in airplane mode, no messages or internet traffic can be transmitted, cutting off the attacker’s ability to monitor activity.
Reboot your phone in safe mode
Android phones allow users to restart in safe mode, disabling all third-party applications. This is an effective way to check if spyware is running in the background. Once in safe mode, reviewing installed apps and uninstalling anything suspicious can help remove hidden tracking software. iPhones don’t offer a safe mode, so iPhone users should review installed apps and configuration profiles in Settings instead.
Scan your phone with a security app
A mobile security app like Malwarebytes can find and remove spyware and other malware that’s hard to spot manually. Run a full scan and remove anything it flags before moving on to more drastic steps.
Disable location services
Turning off location services stops apps and background processes from tracking real-time movements. Many spyware tools continuously monitor GPS data, so disabling location tracking helps prevent surveillance. You can check app-specific location permissions to ensure no unnecessary tracking is occurring.
Perform a factory reset
This is a last resort, but if spyware or malware is deeply embedded within the system, then performing a factory reset may be the only way to fully remove it. Resetting a phone erases all data and restores the device to its original state, eliminating hidden surveillance tools. Back up your files first, but avoid restoring apps from a backup you don’t trust, or the spyware may come back.
Report the tapping incident
If there is strong evidence that your phone is being tapped illegally, report it. In the United States, you can report the crime to your local police and to the FBI’s Internet Crime Complaint Center (IC3). Authorities can investigate further and advise on security measures to prevent future breaches. Reporting also helps protect others.