A modern smartphone stores more personal information than any other household item, and the question of how to check whether an MTS phone is tapped on Android for free is becoming critically important for millions of users. In the era of digital espionage and aggressive marketing, the line between legitimate operator statistics collection and illegal wiretapping often seems blurry. Many subscribers notice strange noises in the handset or rapid battery discharge, which immediately raises suspicions about the intervention of third parties.
However, panic is not always justified technically. Cellular operator has the technical capabilities to intercept traffic only at the official request of intelligence services, and unauthorized wiretapping of subscribers is a criminal offense. However, threats often come not from the cell tower, but from installed malicious applications or vulnerabilities in the operating system itself Android. In this article, we will analyze in detail effective methods for diagnosing your device without contacting paid specialists.
You will learn what system codes allow you to see the forwarding status, how to analyze traffic consumption and what physical signs indicate the presence of a “bug” or spyware. We will look at both built-in security tools Google Play Protectand specific settings of the MTS network, which can help identify anomalies in the operation of your gadget.
Analysis of forwarding and operator USSD codes
The fastest and most reliable method of primary diagnosis is the use of special service codes that interact directly with the switch networks MTS. These commands allow you to find out whether your number is configured to secretly forward incoming calls or SMS to a third party number. Attackers often use this loophole to duplicate your conversations or receive confirmation codes from banks.
To check, enter the following code in the dialing menu: *#21#. After pressing the call button, the screen will display the status of all types of forwarding: voice calls, data calls, faxes and SMS. If “Not forwarded” is indicated next to any item, then everything is in order. If you see an unknown phone number, this is an alarming signal.
There is also a universal reset code for all types of forwarding - ##002#. It's safe and free to use, and it instantly overrides any call forwarding settings that may have been previously activated. It is recommended to perform this action periodically, especially after losing your phone or suspicious calls.
The code ##002# works for most operators, including MTS, and instantly clears forwarding settings at the network level, even if the phone is turned off.
In addition to the basic check, it is worth paying attention to the codes that display the status of services. For example, the code *#62# shows the number to which the call goes when your phone is turned off or out of network coverage. Usually this is the operator's voicemail number, but if a personal mobile number is indicated there, you should immediately contact support.
⚠️ Attention: Some malware can block the display of USSD responses or replace them. If, after entering the code, the window closes instantly without displaying information, this may indicate the presence of active spyware in the system.
Signs of the presence of spyware on the device
Software “bugs” rarely work without a trace, since they require a constant connection to the attacker’s server to transmit recorded conversations or screenshots. This creates an additional load on the smartphone's hardware resources, which an attentive user may notice. The first alarm bell is often an abnormally rapid discharge of the battery, even in the absence of active games or heavy tasks.
Pay attention to the heating of the device body. If your phone gets noticeably warm in standby mode or when simply viewing text, it is possible that the process of recording or sending data is running in the background. Background activity Spyware requires constant access to the microphone and communication module, which physically warms up the processor and radio module.
It is also worth analyzing outgoing traffic. Go to settings and check your mobile data usage statistics. If you see an application with a strange name or a system process that is consuming gigabytes of traffic even though you have not used it, this is a clear sign of an information leak. Spyware is often disguised as system services, such as Android System or Media Storage.
- 📉 A sharp drop in battery life without changing the usual usage scenario.
- 🔥 Heating of the back cover of the smartphone in a pocket or on a table in idle mode.
- 📶 Spontaneous turning on of the screen or backlight in the dark without notifications.
- 📵 Strange delays when turning off the phone or freezing when ending calls.
Another indirect sign may be the appearance of strange sounds during a conversation. Clicks, echoes, static, or hums that weren't there before may indicate that the line is busy or a call is being recorded. However, it is worth remembering that poor communication quality in areas of poor reception MTS can also produce similar effects, so this symptom should be considered in conjunction with others.
Checking installed applications and access rights
Most cases of wiretapping on Android are not related to magic cell towers, but with banal applications that the user installed himself, often without even knowing about their true purpose. Trojans can hide under the guise of flashlights, calculators or games. It is critically important to regularly review the list of installed software and pay attention to the requested permissions.
Go to the menu Settings → Applications → Application Manager and carefully review the entire list. Look for apps without an icon, with an empty name or with suspicious names like System Update (if this is not an official update), Wi-Fi Service etc. If you find an application that you cannot remove or the “Delete” button is inactive, most likely it has received device administrator rights.
To check administrator rights, follow the path Settings → Security → Device administrators. Only Find My Device (Search for device) from Google should be active here. If you see an unknown app there, immediately uncheck it and uninstall the application. Without removing these rights, the virus will not allow itself to be uninstalled.
| Application type | Required rights | Suspicious rights | Risk |
|---|---|---|---|
| Flashlight | Camera (flash) | Microphone, Contacts, SMS | High |
| Calculator | No | Geolocation, Phone | Critical |
| Game | Storage (saves) | Call recording, Network access | Average |
| Antivirus | All system | No numbers. signatures | Average |
Pay special attention to applications with access to Accessibility (Accessibility). This section is often used by legitimate apps to control gestures, but it is through this section that Trojans intercept keystrokes and read the contents of the screen. Path to check: Settings → Accessibility. Disable all suspicious services.
☑️ Application security audit
Diagnostics through the engineering menu Android
For a deeper analysis of the state of the radio module and network, you can use the engineering menu, which is hidden from the average user. This interface provides detailed technical information about the signal, connection to base stations MTS and the current status of test modes. It is accessed through special codes, which may differ depending on the processor manufacturer (MediaTek, Qualcomm) and smartphone model.
Try entering the code ##4636##. If your device supports this command, the Test menu will open. Select "Phone Information". Here you can see the connection status and, importantly, force the network type to switch. For example, choosing a mode GSM only can help you understand if there are problems with switching between standards, which is sometimes used for attacks like Stingray (imitation of a base station).
For devices based on MediaTek processors, the code often works ##3646633##, which opens an extended engineering menu. In section Hardware Testing → Audio you can check the microphone volume levels. If the values in the “Normal Mode” or “Headset” mode are set to maximum without your participation, this may indicate an attempt to increase the sensitivity of the microphone to record ambient sounds.
⚠️ Attention: Making changes to the engineering menu without an accurate understanding of the parameters may lead to loss of communication, a broken speaker, or an IMEI reset. Use this section only to view information (Read-only) if you are not a qualified engineer.
Also in the engineering menu you can track which base station you are connected to. Sharp jumps between towers located far from each other, or connecting to a station with an abnormally high signal level in a place where communication is usually poor, may indicate the operation of an interceptor.
What to do if the engineering menu code does not work?
Many manufacturers (Samsung, Xiaomi, Huawei) block standard codes in their shells. In this case, you can try downloading the Phone Info SAM or Device Info HW application from the official store, which provide similar information in a convenient form without entering secret combinations.
Data protection and factory reset
If you have found confirmed signs of wiretapping or simply want to ensure that your phone is cleared of any possible threats, the most radical and effective method is a full reset to factory settings. This procedure removes all user data, applications and, most importantly, hidden viruses that may have gained a foothold in the system. Before doing this, be sure to save important contacts and photos to external storage or to the cloud.
To perform a reset, go to menu Settings → System → Reset settings → Delete all data. Make sure that the “Clear internal memory” or “Delete all files” checkbox is active. After the reboot, you will receive a clean device, to which you will need to log in again. Do not restore the backup copy of applications immediately, as the virus may come back with it. Google account. Do not restore your application backup right away, as the virus may come back with it.
After the reset, it is critical to change all the passwords that you entered on this device: from mail and social networks to banking applications. This must be done from a “clean” phone or from another trusted device. It is also recommended to check your Google account activity history for unfamiliar logins.
To prevent future infections, install a reliable antivirus from a reputable vendor, for example Kaspersky, Dr.Web or ESET. Update your operating system regularly Androidas security updates close vulnerabilities that hackers exploit. Avoid installing applications from dubious sources and do not follow links in SMS from unknown senders, even if they allegedly come from MTS.
Factory Reset is the only 100% guarantee of removing complex spyware that disguises itself as system processes and is not removed by standard methods.
Legal aspects and contacting MTS
It is important to understand the difference between technical wiretapping and legal traffic control. A telecom operator MTS, like any other, is obliged to provide information about connections to law enforcement agencies only if there is an appropriate court decision within the framework of the SORM system (System of technical means for ensuring the functions of operational-search activities). Independent wiretapping of subscribers by operator employees is prohibited by law and is strictly controlled.
If you suspect that your rights have been violated, you can contact the operator's security service. However, be prepared for the fact that without the sanction of the prosecutor or the court, you will not be provided with details of the connections of other numbers or confirmation of the fact of wiretapping. In the case of real threats to life or blackmail, the only correct solution is to contact the police with a statement about the illegal collection of information.
Remember that many “wiretapping check” services offered on the Internet for money are fraudulent. They do not have access to the operator's equipment and cannot check whether recording is being carried out on the network side. The free methods described in this article provide much more real information about the condition of your specific device.
⚠️ Attention: Legislation and technical regulations of telecom operators may change. For the most up-to-date information about the privacy policy and the processing of personal data, please refer to the official documents on the MTS website or customer service offices.
Frequently asked questions (FAQ)
Can MTS wiretap me without my knowledge by law?
No, the telecom operator does not have the right to wiretap subscribers on their own initiative. This is possible only within the framework of operational-search activities at the request of the intelligence services and with a court sanction. Any other wiretapping is illegal.
Is it true that the code *#21# shows whether the phone is being tapped?
Not really. The code *#21# shows only the call and message forwarding settings. If forwarding is turned on to someone else's number, your calls may be forwarded, but the code itself does not indicate whether the conversation is being recorded or geolocation is being tracked.
How can I find out who called my number if the phone was turned off?
It is difficult to find out for free through the operator. You can check your voicemail forwarding settings using the code *#62#. If forwarding is to an MTS voicemail number, then callers could leave a message there, which can be listened to when you turn on the phone.
Does airplane mode protect against wiretapping?
Airplane mode turns off all radio modules (GSM, Wi-Fi, Bluetooth), so in this mode the phone cannot transmit data about your location or broadcast sound to the network. However, if a virus is already installed on the phone, it can record information and send it as soon as you turn off airplane mode.
What to do if the phone heats up after a call?
Short-term heating after a call is the norm due to the operation of the radio module. If the phone remains hot for a long time in standby mode, check the battery statistics in the settings. High energy consumption by the Mobile Network process or an unknown application may indicate spyware activity.