Signs Your Phone Is Hacked
In this post
A phone that once lasted all day now dies by lunch. Apps you never installed appear on the home screen. Friends ask why you sent them a strange link at 3 a.m. Any one of these can have an innocent explanation. Several of them together are a pattern worth taking seriously, because a hacked phone rarely announces itself with a flashing warning. It whispers, in battery drain and odd behaviour, and hopes you will blame the phone instead of the intruder.
McAfee, the security company, lists nine warning signs that a smartphone may have been hacked, and the list is worth knowing by heart, because the earlier a compromise is caught, the less damage it can do. This guide walks through the signs, explains how phones get hacked, and sets out the checks and fixes McAfee recommends, in an order that keeps your accounts safe.
The battery that dies too fast
A battery draining much faster than usual is one of the most common warning signs. Malware running quietly in the background uses power constantly — sending data, watching activity, or keeping a connection open — and the battery pays for it. McAfee lists unexplained battery drain among its nine warning signs of a hacked smartphone.
Batteries also age, and a two-year-old phone will not hold a charge like a new one. The difference is the pattern. A worn battery fades gradually over months. A hacked phone’s drain often arrives suddenly, with the phone warm when it should be idle, or losing large chunks of charge overnight while doing nothing. Check the battery settings first: both Android and iPhone show which apps used the most power. If an app you barely use sits at the top of the list, or an unknown app appears there, that is evidence worth acting on, not a curiosity to ignore.
A phone that runs hot and slow
Performance trouble is another warning sign. Apps crashing, the phone freezing, pages loading slowly, or the device feeling sluggish during simple tasks can all point to malicious software working in the background. McAfee includes performance issues and a phone that feels hot among the signs, and the two often arrive together: hidden work makes the processor labour, and labour makes heat.
Again, age and full storage cause slowdowns too, so look for a change rather than a single symptom. A phone that was fast last week and crawls this week, with no update and no new apps installed by you, has a story to tell. Restart the phone and see whether the slowness returns immediately. Malware often restarts with the phone, while a one-off glitch usually clears. If the heat and slowness persist after a restart, with no obvious cause, treat it as a warning, not a quirk.
Mystery calls, texts, and apps
Messages you did not send are a loud alarm. McAfee lists mystery calls and texts among its warning signs, and for good reason: malware often uses a hacked phone to spread itself, sending links to contacts, or it signs the phone up for premium services that charge the bill. Friends asking about strange messages from you, or a bill showing calls and texts you never made, should never be brushed aside.
Unknown apps are the same alarm in a different shape. Check the full app list, not just the home screen, for anything you do not recognise or do not remember installing. Malware sometimes hides under a boring name — a “system update” tool, a flashlight, a cleaner — and asks for broad permissions. An app you did not install has no innocent explanation. Remove it, and note its name, because the name may help when checking what else it touched.
Pop-ups are a related sign. A sudden flood of adverts, especially outside a browser or on the home screen, often means adware is installed. Genuine system messages do not beg you to install cleaners or claim you have won a prize. Close them without tapping, and treat their appearance as evidence, not bad luck.
Data spikes and unexplained charges
A phone quietly sending your data somewhere uses mobile data, and the bill shows it. McAfee lists unexplained data spikes among the warning signs, and they are easy to check: both Android and iPhone show data use per app in settings. A spike in an app you barely use, or data use while the phone sat untouched, deserves investigation.
Unexplained charges are the money version of the same sign. Premium texts, subscriptions, or purchases nobody in the house made can mean malware signed the phone up for paid services. Check the phone bill and the app store purchase history, and contact the carrier quickly if charges appear that you did not authorise. Carriers can block premium services, and early reporting protects both the bill and the accounts behind it.
Strange noises or echoes during calls, and sudden loss of service, complete McAfee’s list of nine signs. Call noise alone proves little — networks glitch — but combined with other signs it adds weight. A sudden loss of service can also hint at a SIM-swap attack, where a criminal convinces the carrier to move your number to their SIM card. If service vanishes while the bill is paid and the phone is fine, call the carrier from another phone at once.
How phones actually get hacked
Knowing the doors helps you close them. McAfee names several common routes: sideloading apps from outside the official stores, phishing and smishing messages that trick people into tapping links, public Wi-Fi networks that expose traffic, SIM-swap attacks, and malicious apps or fake updates. None of these require a genius attacker. Most require one tired tap on one convincing message.
Sideloading is the biggest avoidable risk on Android: apps installed from random websites skip the checks of the official store. Phishing works on every phone: a message pretending to be a bank, a delivery company, or a friend, carrying a link to a fake login page. Public Wi-Fi is risky because traffic on an open network can be watched, and a fake hotspot can be worse. Fake updates — a pop-up claiming the phone needs an urgent update, from a website rather than settings — are a classic trap.
The pattern across all of these is trust misplaced once. Security is rarely broken by force. It is usually handed over, willingly, to something that looked official for half a second too long.
First checks you can run today
Start with the built-in tools. On Android, McAfee recommends running a scan with Google Play Protect, which checks installed apps for harmful behaviour and can be found in the Play Store’s security settings. On iPhone, the Safety Check feature reviews what information and access is shared with people and apps, and is worth running when something feels wrong. Both are free, built in, and take minutes.
Next, review permissions. Open the app list and ask of each app: does a torch need my contacts, does a game need my messages, does a photo filter need my location always? Remove permissions that make no sense, and delete apps you do not use. A smaller app list is a smaller attack surface, and most people carry apps they have not opened in a year.
Then check the accounts. Look at recent sign-ins on email and banking apps, change passwords from a trusted device — not from the phone you suspect — and turn on two-factor authentication wherever it is offered. McAfee’s advice is to change passwords from a device you trust, because changing them on a compromised phone can hand the new password straight to the attacker.
What to do if the signs point to hacking
If several signs line up, act in this order. First, remove any unknown apps and restart the phone. Second, run a scan with a reputable security app from the official store. Third, change the passwords of important accounts — email first, then banking, then social media — from a different, trusted device, and enable two-factor authentication. Email matters most, because password resets for almost everything else flow through it.
If problems persist, McAfee advises a factory reset as the stronger fix, after backing up photos and important files. A reset wipes the phone back to its out-of-box state and removes most malware, though it also removes your apps and settings, so the backup matters. After the reset, reinstall apps only from the official store, restore the backup carefully, and watch for any returning symptoms.
Finally, protect the outside world: tell the bank and the carrier what happened, so they can watch for fraud and block premium charges, and report serious cases to the authorities. McAfee notes that victims in the US can report to the FBI’s Internet Crime Complaint Center, known as IC3. Reporting feels like paperwork, but it helps investigators connect cases, and it creates a record if money was taken.
Staying safe after the scare
Prevention is mostly habit. Install apps only from the official store. Keep the phone’s software updated, because updates patch the holes attackers use. Be suspicious of urgent messages asking you to tap a link, especially about deliveries, banks, or prizes. Avoid sensitive logins on public Wi-Fi, or use a trusted VPN if you must. Use a lock screen, strong unique passwords, and two-factor authentication as routine, not as emergency measures.
A hacked phone is frightening, but it is also fixable, and most damage comes from delay rather than from the hack itself. The signs are knowable, the checks are free, and the fixes are straightforward. Trust the pattern, act early, and the phone goes back to being a tool, not a worry.
Frequently Asked Questions
How can I tell if my phone is hacked?
Look for a pattern of signs rather than one symptom: fast battery drain, a hot and slow phone, mystery calls or texts, unknown apps, pop-ups, data spikes, unexplained charges, strange call noises, or sudden loss of service. McAfee lists these nine warning signs, and several appearing together is a strong reason to act. Check battery and data use per app in settings, because a hidden app working in the background leaves traces there.
Can a phone be hacked through public Wi-Fi?
Yes, public Wi-Fi is one of the routes McAfee names, because traffic on an open network can be watched and fake hotspots can imitate real ones. Avoid logging in to banking or email on public Wi-Fi where possible, never enter passwords on a network you do not trust, and be extra careful with any login page that appears after connecting. Keeping software updated and using two-factor authentication limits what an attacker can do even if traffic is seen.
What should I do first if I think my phone is hacked?
Remove any unknown apps, restart the phone, and run a scan with the built-in tools — Google Play Protect on Android, or Safety Check on iPhone. Then change the passwords of important accounts, starting with email, from a different trusted device, and turn on two-factor authentication. If the problems persist, back up photos and files and perform a factory reset, then reinstall apps only from the official store.
Does a factory reset remove hackers from my phone?
A factory reset wipes the phone back to its out-of-box state and removes most malware, which is why McAfee advises it as the stronger fix when problems persist. Back up photos and important files first, because the reset removes apps and settings too, and restore the backup carefully afterwards. After the reset, watch for returning symptoms and reinstall only from the official store, since restoring a compromised backup can bring the problem back.
How do I report a hacked phone?
Tell your bank and your mobile carrier first, so they can watch for fraud, block premium charges, and secure the account, especially if a SIM-swap is suspected. McAfee notes that victims in the US can report to the FBI’s Internet Crime Complaint Center (IC3). Keep notes of strange messages, charges, and app names, because that record helps the bank, the carrier, and investigators connect what happened to your phone with wider fraud.
Sources
- McAfee — How to Tell If Your Smartphone Has Been Hacked (fetched 2026-10-28)
