How to Tell if Someone Put Spyware on Your Phone
If a partner, ex, or family member seems to know things they could only learn from your phone, the unsettling feeling is worth taking seriously. Stalkerware, the consumer-grade spyware sold to secretly monitor another person’s device, can read your messages, log your calls, capture your location, and quietly send all of it to whoever installed it. The good news is that it almost always leaves traces, and you can find them. This guide walks through the real warning signs, how to detect and remove the software safely, the one safety step you must take first if you may be in danger, and the part most articles skip entirely: how the person who installed it can be lawfully identified so police can act.
The Short Version
Common signs of phone spyware are fast battery drain and a warm device when idle, sudden spikes in data usage, sluggish performance or random restarts, and unfamiliar apps with bland names like “System Service” or “Device Health.” The strongest tell is behavioral: someone knows private things they should have no way of knowing. Before you touch anything, read the safety warning below, because removing stalkerware can alert an abuser and escalate the danger. If you are at risk, call 911 and contact the National Domestic Violence Hotline at 1-800-799-7233 first. When it is safe, you can detect it with a security scan, an operating-system update, and as a last resort a factory reset, then lock down your accounts. People Locator Skip Tracing helps with the question the security blogs never answer: lawfully identifying who installed it, so your police report and any protective-order petition name a real person.
Watch: Spotting Phone Spyware
The warning signs, and the safe order to act in.
Watch Overview
Read This First
The most important step has nothing to do with technology.
If the person you suspect installed spyware is an abusive partner, an ex, or anyone who has been controlling or threatening, do not start deleting apps or resetting your phone yet. Stalkerware reports continuously to whoever set it up, and many products send an alert the moment the connection drops or the app is removed. Suddenly going dark can tell an abuser that you have discovered the surveillance, and that discovery is one of the most dangerous moments in an abusive relationship. Removing the software is not always the first move. Staying safe is.
If you feel you are in immediate danger, call 911. For confidential help building a safety plan, contact the National Domestic Violence Hotline at 1-800-799-7233, available around the clock by call or text. The hotline’s advocates work with technology-facilitated abuse every day and can help you decide the safe sequence for your situation, including whether to keep the monitored phone running normally while you set up a separate, clean device the other person does not know about. For an overview of federal resources and victim services, the U.S. Department of Justice Office on Violence Against Women is a reliable starting point. Document what is happening before you change anything, because the evidence on the device today may matter to police and to a court later. Only after you have a safety plan should you move on to detection and removal.
What Phone Spyware Actually Is
This is installed software, not the same thing as location sharing.
The category that worries most people is stalkerware, sometimes called spouseware: commercial apps marketed, often thinly, as tools to “monitor your child” or “keep an eye on employees,” but bought and installed to spy on a partner without consent. Once on the device, stalkerware can quietly capture text messages and chat-app conversations, call logs, photos, browsing history, keystrokes, and GPS location, then upload all of it to an online dashboard the installer logs into from anywhere. It is built to hide. Many products show no icon, run under a disguised name, and survive ordinary restarts.
It helps to know what spyware is not. This page is about software sitting on your phone, which is different from the broader question of how location data alone can expose where someone lives through public records and data brokers. Real stalkerware almost always requires physical access to your unlocked phone to install, usually for several minutes. The exceptions are rare and expensive nation-state tools that ordinary individuals do not have, so for the situations this guide covers, the practical takeaway is powerful: if spyware is on your device, there was a moment when someone had their hands on it. That single fact is the thread that leads back to who did it.
Warning Signs to Watch For
No single sign is proof. Several together is a real red flag.
Fast Battery Drain
Software that records and uploads in the background all day burns power. A phone that suddenly cannot last like it used to is worth a closer look.
Warm When Idle
If the phone feels hot when you have not been using it, a hidden process may be working constantly behind the lock screen.
Unexplained Data Spikes
Stalkerware ships your messages, location, and recordings off the device. Check data usage by app for something you do not recognize eating bandwidth.
Unknown Apps
Scan your full app list for anything you did not install, especially bland names like “System Service,” “Device Health,” “WiFi Service,” or “Battery Optimizer.”
Settings Changed
Spyware needs permissions to work. Look for an unfamiliar device-admin app, a profile you did not add, or security settings that were quietly loosened.
They Know Too Much
The clearest sign is not technical. If someone repeats private messages, brings up places you went, or reacts to plans you never told them, treat it seriously.
How to Detect It
The checks differ a little between Android and iPhone.
On Android. Open your full list of installed apps in Settings, not just the home screen, and read every entry. Turn on and run Google Play Protect from the Play Store menu, then back it up with a reputable mobile security app, since some stalkerware is built specifically to slip past the built-in scanner. Open Settings and look under Security for “Device admin apps,” because monitoring tools often grant themselves administrator rights to resist deletion; an admin entry you do not recognize is a strong clue. Booting into Safe Mode temporarily disables downloaded apps, which can make a hidden one easier to spot and remove.
On iPhone. Stalkerware on iOS usually requires either your Apple ID credentials or a “jailbroken” phone, so check for apps named Cydia, Sileo, or Zebra, which signal a jailbreak that strips Apple’s protections. Open Settings, tap your name, and review the list of devices signed into your Apple ID; remove any you do not recognize, because someone with your password may be reading your synced data without installing anything at all. Then go to Settings, General, VPN and Device Management and delete any configuration profile you did not add yourself, as these can route or capture your activity. Confirm two-factor authentication is on and that the trusted phone number is yours.
Detection is also where careful documentation begins. Photograph the suspicious app, the permissions it holds, the device-admin entry, or the unfamiliar Apple ID device with a second camera before you remove anything. Note the dates and what you saw. The methods professionals use to preserve digital evidence in an online investigation apply here too: a clear, dated record is far more persuasive to police than a memory of an app that is now gone.
How to Remove It Safely
Once you have a safety plan and your evidence, work through these in order.
Confirm Your Safety Plan
Removal can tip off whoever is watching. If there is any risk, talk to a hotline advocate first and decide whether to keep the monitored phone running while you switch to a clean device.
Update the Operating System
Install the latest Android or iOS update. System updates patch the security holes many spyware products rely on and can disable some of them outright.
Run a Security Scan
Use Play Protect and a trusted anti-spyware app to find and quarantine known stalkerware. Revoke device-admin rights from any flagged app so it can be uninstalled.
Factory Reset as a Last Resort
A full reset clears most spyware. Afterward set it up as new and do not restore from the old backup, which can quietly reinstall the same software.
The cleanup is not finished when the app is gone. Whoever installed stalkerware almost certainly knows your passwords, so once your device is clean, change the passwords on your email, cloud account, banking, and social accounts from a different, trusted device, and turn on two-factor authentication everywhere it is offered. Review which devices are signed into each account and sign out anything unfamiliar. If your personal information has been exposed or misused, the U.S. government’s identity-theft recovery resources walk you through reporting and locking down your records. Account hygiene matters because the easiest way back in is not reinstalling spyware, it is simply logging in as you.
Removing It vs. Proving Who Did It
Two different jobs. Most guides only cover the first.
| Goal | What It Takes | Who Handles It |
|---|---|---|
| Find the spyware | App-list review, Play Protect, a security scan, checking device-admin and Apple ID | You, with a security app |
| Remove the spyware | OS update, uninstall, revoke admin rights, factory reset, account reset | You, after safety planning |
| Preserve the evidence | Dated photos and notes of the app, permissions, and account access before deletion | You, then law enforcement |
| Identify the installer Our Lane | Physical-access window, linked accounts, and purchase or payment records traced to a real name | People Locator Skip Tracing |
| Act on it | Police report, criminal charges, or a protective order naming the person responsible | Law enforcement and the courts |
Deleting the app stops the surveillance, but it does not answer the question that actually keeps people up at night: who did this, and how do I make it stop for good? That is a separate investigation, and it is the one we focus on.
How the Installer Gets Lawfully Identified
The spyware leaves a trail back to a person. Here is how we follow it.
Because consumer stalkerware needs hands-on access to install, the investigation starts with a simple, powerful question: who had your unlocked phone, and when? Cross-referencing the install date you documented against your own memory often narrows the suspect list to one or two people, and to specific days. That timeline is the spine of everything that follows.
From there, the work moves to the digital trail the installer left behind. Stalkerware sends its data to an account, and the product was bought from somewhere. Through lawful public-records research and skip tracing, our investigation team can help connect the dots between the dashboard email or phone number, the app-store or vendor purchase, the payment method used, and the real person behind them, the same way we trace a phone number back to an identity in fraud cases. Where a covert tracking device is involved instead of an app, the same approach lets us tie a registration or device to its owner. If an unfamiliar car has been appearing near your home, documenting it can also help, and we explain how to handle a suspicious vehicle on your property without confrontation.
What we deliver is an evidence package, not a confrontation. We never advise you to approach, threaten, or surveil the other person in return, and we do not break into accounts or devices. We work strictly within the law, using public records and permissible-purpose research, and the result is a documented, named individual that police can act on and that supports a protective-order petition. To go deeper on the methods, see our broader skip tracing services and our guide to running down a working phone number for someone. For a legitimate safety matter, an initial locate typically comes back within 24 hours.
Who Comes to Us About Spyware
The thread is the same: stop the watching, and name who is behind it.
Abuse Survivors
Identify the person monitoring them
Family Law Attorneys
Name a stalker for a protective order
Concerned Parents
Check a teen’s phone safely
Stalking Targets
Build a record for police
Small Employers
Investigate misuse of a work phone
Anyone Watched
Turn a hunch into named proof
Send us what you have, even if it feels thin: the date you think your phone was tampered with, a screenshot of the suspicious app or account, an email or number tied to the monitoring, or simply your best sense of who had access. We work only for lawful, permissible purposes, we never promise an outcome we cannot control, and we will tell you honestly what public records can and cannot show. If you are looking at this on behalf of yourself, you may also want to understand how your own information becomes findable in the first place so you can lock it down going forward.
Our Commitment
We will not tell you to confront anyone, retaliate, or break the law to get answers. We do the lawful research that turns a frightening hunch into a named, documented person, so your report to police and any protective order carry real weight. Honest, safety-first, permissible-purpose skip tracing since 2004.
Frequently Asked Questions
What are the most reliable signs of spyware on a phone?
No single sign is proof, but watch for several together: unusually fast battery drain, a device that is warm when idle, unexplained spikes in data usage, sluggish or crashing performance, and unfamiliar apps with bland names. The strongest signal is behavioral, when someone clearly knows private things they should have no way of knowing.
Should I remove the spyware right away?
Not necessarily. If the person who installed it has been abusive or controlling, removing it can alert them and escalate the danger, because many products signal the installer when the connection drops. If you may be at risk, call 911 in an emergency and contact the National Domestic Violence Hotline at 1-800-799-7233 to plan a safe sequence before you change anything.
How is this different from someone just tracking my location?
Location tracking can happen through shared settings, a planted device, or data brokers without anything being installed on your phone. Stalkerware is actual software sitting on the device that reads messages, calls, and more. Because it almost always requires physical access to install, it leaves a clearer trail back to a specific person.
How do I check an iPhone versus an Android phone?
On Android, review your full app list, run Google Play Protect plus a security app, and check Settings for an unfamiliar device-admin app. On iPhone, look for jailbreak apps like Cydia or Sileo, review the devices signed into your Apple ID, and remove any configuration profile you did not add under VPN and Device Management.
Will a factory reset get rid of it?
Usually yes. A full factory reset clears most consumer spyware. The key is to set the phone up as new afterward rather than restoring from your old backup, which can quietly reinstall the same software, and to change your account passwords from a separate trusted device.
Can you actually find out who installed it?
Often, yes. Because the software needs hands-on access, the install date and the people who had your phone narrow the field fast. From there, lawful public-records research and skip tracing can connect the monitoring account, the purchase, and the payment method to a real person. We never break into accounts or devices; we work strictly within the law.
What should I save before deleting anything?
Photograph the suspicious app and its permissions, any unfamiliar device-admin entry, and the list of devices on your account, using a second camera. Note the dates and what you observed. Dated documentation is far more useful to police and to a court than the memory of an app that has since been removed.
Is it legal to investigate who put spyware on my own phone?
Identifying who unlawfully surveilled you, using public records and permissible-purpose research, is lawful, and the result supports a police report or a protective order. This page is general information, not legal advice, and we are not a consumer reporting agency, so our research is not for employment, tenant, or credit decisions.
Related Guides
More ways our investigation team can help.
Found Spyware on Your Phone? Find Out Who.
We lawfully trace the person behind the surveillance, so your report to police and any protective order name a real individual, typically with an initial locate within 24 hours. Contact us to get started.
Start Your Request →
