How to check remote calls on Android: a complete guide

Modern smartphones store a colossal amount of personal information, and the issue of their security becomes a priority for millions of users. The situation when you notice strange noises in the handset, unexplained heating of the device or mysterious delays in sending messages often causes panic and suspicions of wiretapping. Many people immediately begin to look for a way to check remote calls on Android, fearing that attackers or unscrupulous acquaintances are gaining access to the history of calls and conversations in real time.

It is important to understand that the concept of “remote call” in the context of mobile security can be interpreted in two ways: either as an attempt to remotely execute commands (ADB, TeamViewer), or as a hidden interception of calls through third-party software. Analysis of system logs and knowledge of the hidden functions of the operating system make it possible to identify traces of such interference. In this article, we will analyze technical diagnostic methods that will help you determine whether your phone has become the target of surveillance.

Before embarking on complex manipulations, it is necessary to conduct an initial visual and logical assessment of the condition of the gadget. Often signs of compromise lie on the surface, but are ignored due to inattention. We'll look at how to use built-in diagnostic tools and third-party utilities to deeply scan your system for spyware or suspicious network activity.

Analysis of call history and system logs

The first step in diagnostics is a thorough examination of the standard call log. Attackers often try to hide their actions by deleting records of incoming or outgoing calls, but the operating system Android keeps deeper logs that are not always accessible through the standard interface. Checking these records requires care, as some system processes can masquerade as normal calls.

Pay attention to short calls lasting 1-2 seconds, especially if they occurred at night or at times when the phone was in your hands, but you did not perform any actions. Such “micro-calls” may indicate an attempt to activate the microphone or check the availability of the device by the remote server. For detailed analysis, you can use special logger applications that record all telephony events in a separate file.

⚠️ Attention: Some system codes and logs may differ depending on the version of Android and the manufacturer’s shell (Samsung OneUI, Xiaomi MIUI, Huawei EMUI). If you are not sure of the purpose of a specific log entry, it is better to check the official documentation of the manufacturer.

You can use developer mode to gain access to extended logs. By activating it, you will be able to view detailed reports on the operation of communication modules. This will help identify processes that initiate calls without the user's knowledge. System logs often contain information about which application requested access to telephony at a particular point in time.

• 📞 Check the log of incoming and outgoing calls for unknown numbers.
• 📉 Pay attention to sudden surges in traffic in the background during calls.
• 🔍 Look in the logs for processes with names containing the words "call", "dialer" or "phone", which are not system ones.

Using hidden codes for diagnostics

The Android engineering menu contains many hidden sections designed for testing equipment and diagnosing the network. By entering special USSD codes in the Phone application, you can access call forwarding information, which is key to the question of how to check deleted calls. These codes allow you to see exactly where your calls are forwarded if you do not answer the phone or are busy.

One ​​of the most useful codes is ##002#, which cancels all types of forwarding. However, before resetting the settings, it is important to check the current status. The code *#21# shows the status of all types of voice, data, fax and SMS forwarding. If you see a number that is not familiar to you, this may be a sign that your calls are being monitored or diverted to third parties.

Another important aspect is checking the network status and connection type. The code ##4636## opens the testing menu, where you can see detailed information about the connection. This section displays information about which applications have recently used the network. Anomalous activity This section may indicate hidden data transfers or remote access.

It is worth noting that on some modern smartphones, manufacturers block some of the engineering codes for security purposes. If the code does not work or an error message is displayed, this does not always mean the presence of a virus, but requires checking through alternative methods, for example, through the telecom operator settings in your personal account.

Monitoring active applications and permissions

Modern apps for remote control (the so-called stalkware) are often disguised as harmless utilities: calculators, flashlights or system services. To identify them, it is necessary to audit installed applications. Go to Settings → Applications and carefully study the list. Pay special attention to applications that do not have an icon or the name looks like a bunch of random characters.

Analysis of granted permissions is critical. The calling app should not have access to the camera, and the flashlight should not ask for permission to read contacts or send SMS. In new versions of Android (starting from 12th) there is a privacy indicator: a green or orange dot in the corner of the screen indicates that the microphone or camera is working. If you see this indicator in the background when you are not using the phone, this is a direct sign of a hidden process running..

It is also worth checking the list of device administrators. Attackers often give their apps administrative rights so they can't simply be uninstalled. Path to check: Settings → Security → Device Administrators. If you see an unknown application there, immediately disable its rights and delete it.

• 📱 Sort applications by installation date and look for suspicious matches with the beginning of problems.
• 🔒 Check the "Special" section capabilities" for the presence of unknown services with high rights.
• 👁️ Monitor the microphone usage indicator in the status bar.

Checking via ADB and computer diagnostics

For advanced users, the most effective way to check is to use the Android Debugging Bridge (ADB). This tool allows you to access system logs in real time and see all running processes, including those that are hidden from the average user. To work, you will need a computer and installed ADB drivers.

By connecting the phone to the PC in debugging mode, you can display a list of all installed packages. The command adb shell pm list packages will show all packets, and filtering by keywords will help you find suspicious ones. For example, apps for remote control often contain the words “team”, “remote”, “control” or “assist” in the name.

adb logcat | grep -i "call\|phone\|dial"

Running the log monitoring command above will allow you to see in real time all events related to telephony. If call entries appear in the log when the phone is at rest, this indicates an automated remote call. Logging via ADB is one of the most reliable methods, since system logs are difficult to fake or hide even with root access without special knowledge.

Incorrect removal of system packages can lead to unstable operation of the device. If you are unsure of the purpose of a particular process, it is better to search the Internet for its package name before taking action.

Network activity and traffic analysis

Any remote call or data transfer leaves a trace in network traffic. If your device is constantly sending packets of data, even when the screen is off and you are not using the Internet, it is a cause for concern. Built-in traffic monitoring in Android allows you to see which application is consuming the most data.

Go to Settings → Network and Internet → Data usage. Analyze the list of applications. If an unknown process or system service with a strange name is using gigabytes of traffic, it is most likely transferring audio or video from your device. It is also worth paying attention to background data transfer.

Symptom	Normal behavior	Suspicious behavior	Action
Traffic consumption	Only with active use	Permanent background even when sleeping mode	Limit background mode
Network indicator	Blinks when pages load	Always active without user action	Check processes
Temperature	Normal	Heating in the modem/processor area	Check running tasks
Battery charge	Smooth discharge	Sharp drop in percentage per hour	Analysis of battery statistics

For a deeper analysis, you can use firewall applications that show which servers the application is accessing. If the "calculator" tries to connect to a server in another country, this is a clear sign of malicious activity. Firewall allows you to block suspicious connections without uninstalling the application immediately, which can be useful for collecting evidence.

Protection against re-intrusion

Once you have checked the device and may have found traces of tampering, it is critical to prevent re-infection. Simply uninstalling an application is often not enough, as malicious code may be embedded deep within the system or have self-healing mechanisms. The first step should be a complete change of passwords for all accounts, especially Google and social networks.

Be sure to perform a full scan of the device using reputable antivirus software. It is recommended to use not only the built-in Google Play Protect, but also specialized scanners such as Malwarebytes or Kaspersky. They are able to detect known spyware signatures that may have remained on the system.

⚠️ Attention: If you have discovered serious surveillance, simply removing the virus may not be enough. An attacker could gain access to backup recovery codes. It is recommended to perform a full factory reset (Factory Reset) after saving important data to external storage.

As a preventative measure, disable the installation of applications from unknown sources. This feature is limited by default on Android, but users often activate it themselves by accidentally downloading a file from the browser. Regularly updating the operating system also closes vulnerabilities through which hackers can gain remote access.

What to do if the reset did not help?

If the problem returns after a full reset, it means that malware may have infiltrated the recovery partition or gained superuser rights. In this case, you need to flash the device via a computer using official utilities (Odin, MiFlash, etc.).

Do not forget about the physical security of the device. Do not leave your phone unlocked in the presence of strangers and use a reliable screen lock method, such as a complex pattern or biometrics in combination with a PIN code.

Frequently asked questions (FAQ)

Can the telecom operator see my remote calls?

The telecom operator sees all calls, passing through its network, including time, duration and numbers. However, the content of the conversation (voice) is usually not recorded or listened to by the operator without court approval. Remote calls initiated by applications are also displayed in billing as regular calls or as data transfer, depending on the method.

How to find out who called if the number is hidden?

It is impossible to find out the number of a hidden call using standard phone means. There are paid services and caller ID apps, but their effectiveness is limited. To obtain information about hidden numbers in case of threats, you need to contact law enforcement agencies, who can make a request to the operator.

Is it safe to use applications for recording calls?

Using third-party applications for recording calls carries risks. Many of them require broad permissions and may transfer your recordings to their servers. In the latest versions of Android, Google has limited the ability to record calls with third-party applications for privacy reasons, so be careful when choosing such software.

What is the code *#9900# and is it worth using it?

The code *#9900# is used mainly on Samsung devices to enter the system dump menu (SysDump). It allows you to clear logs and change some debugging options. It is better for an ordinary user not to change the settings there without understanding the consequences, as this may affect the stability of the phone.