A modern smartphone stores more information about your life than any personal diary. From geolocation and correspondence history to photos and banking information. This is why the question of how to check if a phone is being tracked becomes critical for millions of Android users. The ability to remotely access the device attracts not only cybercriminals, but also unscrupulous marketers, and even jealous partners.
The operating system Android, due to its openness, provides ample opportunities for both legitimate use and the hidden installation of spyware. Unlike closed ecosystems, here it is easier for an attacker to introduce malicious code disguised as a harmless utility. However, the system is not defenseless: there are obvious and hidden indicators that indicate the device has been compromised.
In this article we will examine in detail diagnostic algorithms, signs of infection and cleaning methods. You will learn to distinguish real threats from software glitches and will be able to independently ensure the digital security of your gadget without turning to expensive specialists.
Indirect signs of the presence of spyware
The first warning sign is often changes in the behavior of the device that cannot be explained by normal load. If your smartphone begins to behave strangely, you should take a closer look at the details. Spyware work in the background, constantly transferring data to a remote server, which creates an increased load on system resources.
⚠️ Attention: Rapid battery drain does not always mean a virus. A worn-out battery or poor cellular network signal gives similar symptoms.
Pay attention to the discharge rate. If a phone that previously lived quietly until the evening now requires charging by lunchtime under the same usage scenario, this is an alarming signal. Malware constantly activates the microphone, camera or GPS module, which consumes a colossal amount of energy.
It is also worth checking the temperature of the case. Even at rest, when the screen is off and you are not playing heavy games, the device can become noticeably warm. This happens because it processor is busy processing and sending stolen information. Overheating in standby mode is one of the surest signs of hidden activity.
Analysis of mobile traffic consumption
Spy apps need to transfer the collected data: audio recordings of conversations, screenshots, location history. All this requires a constant communication channel. If you don't watch high-definition videos or download large files, but your traffic limit is exhausted alarmingly quickly, someone else is probably using your Internet.
You can check this through the built-in system settings. Go to menu Settings → Connections → Data usage. Statistics for each application are displayed here. Carefully study the list of apps that consume traffic in the background.
Pay special attention to system services with unclear names or applications that you have not used for a long time. If you see that some “Calculator” or “Flashlight” has transferred hundreds of megabytes of data overnight, this is a clear sign that a spyware module is hidden under the label. Trojan or spy module.
| Sign | Normal behavior | Suspicious behavior |
|---|---|---|
| Background traffic | Less than 50 MB per day | Hundreds of MB or GB without activity |
| Temperature | Room or slightly warm | Hot case in sleep mode |
| Pop-up advertising | Only in the browser or games | On the desktop and in system menus |
| Operation speed | Stable | Constant freezes and lags |
For accurate diagnostics, turn off Wi-Fi and leave only mobile data on for a couple of hours. If traffic consumption continues to increase without your actions, look for malware.
Checking the list of installed applications
The easiest way to detect surveillance is to manually review all installed apps. Hackers often disguise their tools as system utilities or give them names similar to legitimate services, for example, System Update instead of System Service.
Go to section Settings → Applications. View the entire list, including those hidden by default. Look for apps without an icon, with a transparent icon, or with a name consisting of a string of characters. Often such apps do not have a description and take up a minimum of space so as not to attract attention.
Applications with device administrator rights are especially dangerous. They can block their deletion in the usual way. To check them, go to Settings → Security → Device administrators. If you see an unknown app there with a checkmark, immediately revoke its rights and delete it.
☑️ Audit installed applications
Do not forget that some legal applications for parental control or finding a lost phone (for example Find My Device) can also be used for surveillance if an attacker gains access to the account. Removing such apps should be a conscious decision.
Diagnostics through the engineering menu and USSD codes
The Android operating system has hidden diagnostic tools that can be accessed through special codes. They allow you to find out where your calls and messages are redirected, which is a classic method of intercepting communications.
Open the Phone application and enter the code *#21#. Information about the forwarding status will appear on the screen. If you see the status “Not forwarded” next to all items (voice, data, fax, SMS), then from this point of view everything is clear. If any phone number is indicated that you did not set, this is a sign of interception.
Also useful is a code *#62#that shows where calls go when your phone is turned off or is out of network coverage. This will usually show your carrier's voicemail number. If there is another number there, this is a cause for concern.
What to do if someone else's forwarding number is found?
If you find an unknown number in the forwarding settings, cancel it immediately by dialing the code ##002#. After this, it is recommended to change the password for your telecom operator account.
Remember that these codes do not work on all smartphone models and depend on the firmware version and telecom operator. On some modern devices, such as newer models Samsung or Xiaomi, access to these menus may be limited by the manufacturer.
Analysis of access rights and permissions
Modern versions of Android strictly control application rights. The spy app will not be able to record your conversation or take a photo without the appropriate permission. Therefore, regular audit of access rights is a mandatory security procedure.
Go to Settings → Privacy → Permission Manager. Check out the Camera, Microphone, Geolocation, and Contacts categories. See which apps have access to this sensitive data. If a simple flashlight or puzzle game requires access to the microphone and location, this is critical vulnerabilityrequiring immediate removal of the application.
⚠️ Attention: The settings menu interface may differ depending on the manufacturer's shell (MIUI, OneUI, ColorOS). Look for sections with the words "Permissions", "Privacy" or "Permissions".
Also pay attention to the "Privacy Indicator" feature. In Android 12 and above, a green dot appears in the top right corner of the screen when an app is using the camera or microphone. If you see this dot when you are not using these features, it means someone is secretly recording.
Regularly checking application permissions is the most effective method of preventing personal data leakage in the early stages of infection.
Radical measures: reset and protection
If you find clear signs of surveillance, but cannot find a specific one culprit application, or if malicious code is deeply embedded in the system, the most reliable solution is a full factory reset. This will delete all data, including hidden Trojans.
Before the procedure, be sure to save important contacts and photos to an external drive or to the cloud, but do not restore the backup copy of applications immediately after the reset, as the virus may return with it. Perform a reset via the menu Settings → System → Reset settings → Delete all data.
After returning the device to its factory state, install a reliable antivirus from a well-known vendor, for example Kaspersky or Dr.Web, and conduct a full scan. In the future, install applications only from the official store Google Play and avoid dubious sites.
For maximum protection, enable two-factor authentication in your Google account. This will prevent remote access to the device even if the password is stolen. Remember that security is a process, not a one-time action.
Frequently asked questions (FAQ)
Can a phone listen to me without the Internet?
Sound recording is possible without an active connection, but an attacker will be able to transfer data only when a network appears. Some viruses accumulate records in the internal memory and send them in a packet when connected to Wi-Fi.
Does airplane mode help against surveillance?
Airplane mode disables all wireless modules, including cellular communications, Wi-Fi and Bluetooth. In this state, remote access to the phone is impossible, but if the virus has already recorded data, it will transfer it immediately after the mode is turned off.
How to check your phone for viruses without installing applications?
Use the built-in service Google Play Protection. Go to the Play Market store, click on the profile icon and select "Play Protection". Start scanning. This is a basic but effective tool for detecting known threats.
Can intelligence agencies spy on a phone?
Theoretically, yes, using zero-day vulnerabilities or telecom operator equipment. However, such methods are aimed at specific individuals and require enormous resources. The average user should be more afraid of commercial spies and scammers.
Is it safe to use public Wi-Fi?
No, public networks are often not secure. Attackers can intercept traffic. For safe surfing, use the mobile data or a reliable VPN service that encrypts your connection.