How to know if your phone has spyware: 7 signs and what to do

You finish a private conversation and minutes later the other person already knows what was said — without you telling them. Or you notice the phone heats up with no app open, that the battery drains faster than usual. This set of signs has a name: spyware. The problem is that these programs are designed to be exactly that — invisible. This guide walks through 7 concrete indicators and the steps to check your Android right now.

What phone spyware is

Spyware is software that monitors a device in the background without the owner's knowledge: it captures messages, logs calls, accesses real-time location and, in more sophisticated versions, remotely activates the camera and microphone. There are two main types:

• Commercial stalkerware — apps like mSpy and FlexiSpy, sold legally as "parental control" or "employee monitoring," but frequently used in contexts of domestic abuse and partner control.
• Malicious APKs — files installed outside the Play Store, often disguised as legitimate apps (flashlight, PDF reader, system update).

In both cases, installation requires physical access to the unlocked device or social engineering to trick the victim into installing the file. A full explanation of how that persuasion works is in the post on social engineering.

7 signs your device might have spyware

No single sign on its own confirms an infection — there are benign explanations for each. The real warning is when several appear at the same time, especially after a suspicious event (the phone went missing for a few hours, someone asked to "check something" on your device).

1. Battery draining much faster than usual

Spyware runs constantly in the background sending data to a remote server. That processing consumes power continuously. If the same daily use now lasts hours less, it's worth investigating.

2. Overheating without heavy use

A hot phone with the screen off or running only lightweight apps points to hidden processing. Spyware that records audio or streams video demands heavy CPU even when the device looks idle.

3. High background data usage

To exfiltrate information — messages, photos, recordings — spyware needs a connection. If your data usage has gone up without any change in habits, an app may be sending content without your authorization.

4. Camera or microphone activating without you opening any app

On Android 12 and later, a green indicator appears in the top corner of the screen when the camera or microphone is in use. If you saw that dot with the phone "at rest," take a screenshot immediately as a record.

5. Screen turning on by itself (especially at night)

Spyware that receives remote commands can briefly wake the screen while executing a task. Waking up in the middle of the night to find the screen lit with no visible notification is a sign to take seriously.

6. Unknown apps only visible in Settings

Stalkerware rarely shows up on the home screen. Go to Settings > Apps > See all apps (include system apps) and look for generic names you didn't install: "SystemService," "PhoneManager," "SyncHelper." A quick search for the name confirms whether it's a legitimate manufacturer app.

7. The phone takes a long time to shut down or hangs on restart

Before shutting down, Android closes every process. Spyware trying to persist or send one last batch of data can visibly delay that process.

How to confirm it: step-by-step check on Android

How do I check if an app is using background data for no reason?

Go to Settings > Network & Internet > Data usage > Background data. Sort by usage and look for apps you don't recognize. Any app burning tens of megabytes in the background with no known function deserves a closer look.

Beyond data usage, check these three areas:

• Device administrators — Settings > Security > Device admin apps. Spyware needs these permissions to resist uninstallation. If anything shows up beyond the corporate MDM apps you recognize, something's wrong.
• Accessibility — Settings > Accessibility > Installed apps (or "Downloaded services"). Stalkerware registers here to capture text from other apps. Revoke access from any unknown service.
• Malwarebytes scan — In independent tests run by the EFF and AV-Comparatives in 2025, Malwarebytes detected 100% of the stalkerware products tested. Install it from the Play Store, run a scan, and check whether anything is flagged as "Android/Spyware" or "Android/Monitor."

What to do if you confirm an infection

Don't tip off the suspect right away. If the spyware is part of a domestic abuse or stalking situation, alerting the person could escalate the risk. Before doing anything else:

1. Document everything with screenshots (installed app, permissions, data usage).
2. If the situation involves personal safety, seek specialized help before acting on the phone.
3. To remove it: revoke Device Administrator permissions first. Without that, Android blocks the uninstall. Then uninstall the app normally.
4. The definitive fix is a factory reset. But be careful: restoring a contaminated backup reinfects the device. Restore contacts and photos manually, and only reinstall apps you recognize.

How to keep it from happening again

• Never leave your phone unlocked around people you don't fully trust — the PIN is your first line of defense.
• Don't install APKs from outside the Play Store. If someone insists you install a "special app," that's a red flag.
• Keep Google Play Protect active (Play Store > your profile icon > Play Protect > Scan apps).
• Review location, microphone and camera permissions periodically — especially for third-party apps you rarely use.

For hardening the device systemically — a strong PIN, encryption, blocking external installs — the step-by-step guide is in 8 essential Android security settings. And if you want to understand why people are able to install spyware on someone else's phone without them noticing, the post on OPSEC explains the behavioral gaps that open that door.