Suspicious behavior of the smartphone, rapid battery drain or strange sounds during calls - all this may indicate unauthorized access to your Androiddevice. In the digital age, wiretapping of mobile phones has become a real threat, and attackers use both legal tools (for example, parental controls) and malicious software for surveillance. But how can you make sure that your phone is really being tapped and not just buggy?

In this article we will look working verification methods from standard USSD codes to analysis of system logs, and we will also tell you which signs should alert you. It is important to understand: some methods require technical knowledge, while others are accessible even to beginners. The main thing is to act systematically and not skip details.

We warn you right away: if you find surveillance, do not panic. Modern Androiddevices (starting from version 10) have built-in protection mechanisms, but they must be used correctly. Now let's move on to practice.

Signs of wiretapping: when to sound the alarm

Before checking your phone for spyware, pay attention to indirect signsthat may indicate wiretapping. They can easily be confused with ordinary failures, but taken together they should alert you:

  • 🔋 The battery drains too quickly - even in standby mode. Spyware often runs in the background, consuming resources.
  • 📡 The phone heats up for no apparent reason. If the device heats up when simply viewing messages, this may indicate hidden processes.
  • 🔊 Extraneous noise during calls: clicks, echoes or voices. A classic sign of wiretapping via IMEI or SIM card.
  • 📱 Spontaneous reboots or turning on the screen. Some spy applications are activated according to a schedule.
  • 📶 Unexplained increase in traffic. Check your data consumption in Settings → Network and Internet → Mobile traffic.

It is especially dangerous if these symptoms appear after installing an unknown APK file, connecting to public Wi-Fi, or physical access to the phone of third parties. In such cases, the likelihood of wiretapping increases significantly.

⚠️ Attention: Some symptoms (for example, rapid battery drain) may be caused by battery wear or background updates. Always check several factors at the same time.
📊 Have you ever suspected that your phone was being tapped?
Yes, there were suspicions
No, but the article made me think
I checked before, but didn’t find anything
This is paranoia, I didn’t have this

USSD codes for checking wiretapping on Android

The fastest way to check your phone for call forwarding or surveillance is to use secret USSD codes. They work on all Androiddevices, regardless of model (Samsung, Xiaomi, Huawei etc.) and firmware version. Important: codes may differ depending on the telecom operator (MTS, Beeline, MegaFon, Tele2).

Enter the following combinations in the application Phone (as a regular number) and look at the result:

Code Purpose What should be displayed
*#21# Checking call forwarding If active, the number where calls are forwarded will be displayed
*#62# Checking forwarding if unavailable Number where calls are forwarded if the phone is turned off
##002# Reset all redirects Message about successful reset (if active)
*#06# IMEI check A unique device identifier will be displayed (must match the sticker under the battery)

If after entering #21# or #62# you see an unknown number - this is 100% sign of wiretapping. Immediately reset the forwarding command ##002# and contact the operator to block the SIM card.

⚠️ Attention: Some operators may use legal forwarding for service services (for example, voice mail). Check details in your personal account or with support.

Reset all forwarding with code ##002#

Call the operator and block SIM card

Check your phone for viruses

Change account passwords

-->

Checking through the engineering menu (for advanced)

If USSD codes did not produce results, but suspicions remain, you can look into engineering menu (Engineering Mode). This method is suitable for experienced users, as careless actions can disrupt the operation of the phone. The instructions are relevant for most devices on Qualcomm Snapdragon (for example, Samsung Galaxy, OnePlus, Xiaomi Redmi).

To open the engineering menu:

  1. Open the application Phone.
  2. Enter the combination ##4636## or ##197328640## (for MTKprocessors).
  3. Go to the section Usage Statistics or Battery Information.
  4. Check the list active processes for the presence of suspicious applications (for example, com.android.sec.phone with high traffic consumption).

In the engineering menu you can also check the status of the radio module:

  • 📡 Go to Radio Information → Network.
  • 🔍 Look to the setting Call Forwarding —if it is active without your knowledge, this is a sign of interference.
  • 📊 In the Battery History section, check which applications are draining your battery in the background.

On some devices (for example, Huawei or Honor) the engineering menu may be blocked by the manufacturer. In this case, use alternative methods from the following sections.

What to do if the engineering menu does not open?

On some firmware (for example, MIUI or EMUI) access to the engineering menu is limited. Try:

1. Install the application MTK Engineering Mode (for Mediatek).

2. Use ADB commands (PC and USB debugging required).

3. Check the phone via specialized antiviruses (for example, Kaspersky Mobile or Dr.Web).

Analysis of system logs for the presence of spyware

Spyware often leaves traces in system logs (logcatTo view them, you will need access to ADB (Android). Debug Bridge) and computer. This method is suitable for users who are ready to delve into technical details.

Instructions for checking logs:

  1. Enable Developer mode on your phone: go to Settings → About phone and click 7 times on Build number.
  2. Activate USB debugging in Settings → System → For Developers.
  3. Connect the phone to the PC, install ADB Tools and run the command: 
    adb logcat | findstr "audio record"

    This command will display all entries associated with audio recording.

  4. Look for suspicious processes, for example: 
    com.example.spyapp

    or unusual calls to the microphone.

If there are unknown packets in the logs or frequent calls to the microphone / camera without your knowledge - this is a direct sign of spying. For further analysis, you can save the logs to a file: 

adb logcat -d > log.txt

and study it using a text editor.

💡

If you do not understand ADB, use applications for analyzing logs, for example Logcat Reader or aLogcat (require root access).

Checking installed applications for spyware

Many wiretapping apps are disguised as legitimate applications (for example, calculators, flashlights or games). To identify them, you need to carefully analyze the list of installed software. Start by checking permissions:

How to find suspicious applications:

  1. Go to Settings → Applications.
  2. Sort the list by installation date - pay attention to apps that appeared recently and without your knowledge.
  3. Check the permissions of each application. You should be wary of:
    • 🎤 Access to the microphone (if it is not a messenger or voice recorder).
    • 📷 Access to the camera (for unobvious applications).
    • 📍 Access to geolocation in the background.
    • 📞 Reading SMS/call log.
  • Use VirusTotal or MetaDefender to scan APK files for viruses.

    • Pay special attention to applications with names like: System Update, Android Service, Test Provider —spies often hide under them. If you find one do not delete it immediately: first back up your data and prepare to reset your settings.

    💡

    Even legitimate applications (for example, Truecaller or Clean Master) can collect more data than needed. Check their permissions regularly!

    How to check a phone for wiretapping without root access

    Not everyone is ready to receive rootaccess or understand ADB. Fortunately, there are ways to check your phone for wiretapping without deep technical knowledge. Here 3 working methods:

    • 🔍 Antivirus scan. Use Kaspersky Mobile, Bitdefender or Malwarebytes. They will detect most known spyware (for example, Pegasus, Cerberus).
    • 📡 Network scan activity. Install NetGuard or GlassWire —these applications will show which apps are transferring data in the background.
    • 🔊 Microphone test. Start the recorder, put the phone in a quiet place and listen to the recording for interference or extraneous sounds.

    Another effective method is check via Safe Mode (safe mode). It disables all third-party applications, and if there are problems. (for example, rapid battery drain) will disappear - one of the installed software is to blame. To enter Safe Mode:

    1. Hold the button Shutdown.
    2. Hold your finger on the option Turn off the poweruntil You will be prompted to switch to safe mode.
    3. Confirm the action.

    T Safe Mode check the behavior of the phone for 10-15 minutes. If the suspicious symptoms have disappeared, look for the virus among the installed applications.

    What to do if your phone is really being tapped

    If you find evidence of surveillance, act quickly and systematically. Here is a step-by-step plan:

    1. Disconnect the phone from the Internet (airplane mode or turning off mobile data/Wi-Fi). will stop the transfer of data to spyware.
    2. Delete suspicious ones applications via Settings → Applications. If they are not deleted, this is a sign of superuser rights (root) of the attacker.
    3. Reset settings to factory settings:
      • Go to Settings → System → Reset settings.
      • Select Delete all data.
      • After reset do not restore data from a backup copy —it may contain spyware.
  • Change all passwords (email, social networks, banking applications) from another device.
  • Contact a specialistif you suspect a targeted attack (for example, through PegasusIn some cases, the phone will need to be re-flashed.

    • If wiretapping connected with SIM card (for example, through call forwarding), replace it with a new one in the operator's salon. Ask to check the activity history of your number - sometimes scammers connect paid services to disguise surveillance.

    ⚠️ Attention: After resetting the settings, the phone will become “clean”, but if the attacker had physical access to device, he could install firmware with a built-in spy. In this case, only a complete flashing via Odin (for Samsung) or Fastboot (for other brands) will help.

    FAQ: Frequently asked questions about Android wiretapping

    Is it possible to wiretap a phone via Wi-Fi?

    Yes, if an attacker has connected to your network or uses vulnerabilities in the router. Always change the standard Wi-Fi password and turn off WPSFor protection, use VPN (For example, ProtonVPN) and check the connected devices in the router settings.

    How to check if other devices are connected to my phone via Bluetooth?

    Go to Settings → Connected devices → Bluetooth and check the list of paired ones Remove unknown gadgets. You can also use applications like Bluetooth Scanner to search for hidden connections.

    Can the phone be monitored via instant messengers (WhatsApp, Telegram)?

    Technically yes, if:

    • Your account has been hacked (check active sessions in the messenger settings).
    • Software has been installed to intercept messages (for example, mSpy).
    • Synchronization with the cloud is enabled, to which third parties have access.

    Enable two-factor authentication and regularly check the list of devices in WhatsApp Web/Telegram Devices.

    Do cases with protection against wiretapping help?

    Cases with Faraday cage (for example, Silent Pocket) block signals, but they do not protect against spyware already installed on the phone. It is advisable to use them to store the device in safe places (for example, during important negotiations).

    Can a mobile operator listen to my calls?

    By law, operators are required to provide data to law enforcement agencies upon request, but independent wiretapping without sanctions is prohibited. If you suspect illegal interference, write an official request to the operator’s support with a request to check the activity of your number.