How to Check Your Phone for Spyware or Stalkerware (Android and iPhone)

By Thomas Lovas Lokoy · Published October 25, 2026 — researched and drafted with AI assistance from published sources; edited and published by NorwegianSpark SA.

Spyware on an ordinary person's phone is usually stalkerware: an app that someone who had their hands on your unlocked phone installed to watch your messages, photos and location. On Android, check that Google Play Protect is still switched on and run a scan, go through your installed apps and their permissions, and get a second opinion from a security app with a good stalkerware detection record. On an iPhone, run Safety Check (iOS 16 or later), review the devices signed in to your Apple Account, and look for apps and configuration profiles you did not install. If you think a partner, ex-partner or someone else close to you put it there, read the safety section below before you remove anything.

	Stalkerware	Mercenary spyware
What it is	Commercially available apps that let someone secretly spy on another person through their phone	Spyware such as NSO Group's Pegasus, used in individually targeted attacks
Who uses it	Often a current or former partner	Historically associated with state actors and the private companies working for them
How it gets on	On Android, almost always through physical access to the unlocked phone	Remote attacks that Apple says cost millions of dollars
Who is targeted	Anyone; it is easy to buy and install	A very small number of people, often journalists, activists, politicians and diplomats
What finds it	A security app with a stalkerware record, plus the checks below	Apple threat notifications; the user rarely can

If someone close to you may be watching, start here

The Coalition Against Stalkerware, which brings together domestic violence organisations and security companies, makes a point that changes how you should approach every step below: if someone is monitoring your device, they can see any searches you make for help. If that is a concern, use a device the person has never had physical access to when you look for information or support, and contact your local authorities if you are in immediate danger.

Apple's personal safety guide gives a similar caution: before making changes or deleting information, consider the potential impact on your safety and privacy. In practice, an app that suddenly stops reporting, or sharing that suddenly ends, may tell the person who set it up that you have noticed. A support organisation can help you plan that moment and keep evidence first. The Coalition keeps a list of support services by country, and in the United States the National Domestic Violence Hotline is on +1 800 799 7233.

Signs worth taking seriously

The NCSC lists signs that a device may be infected: it runs slowly, restarts by itself, closes or opens apps on its own, shows pop-ups from apps you do not recognise, or people you know receive unexpected messages from you. It also notes that a phone which has been rooted or jailbroken, when you did not do it yourself, can be a good indication that something is wrong.

Stalkerware is built not to show symptoms. The Coalition describes it as running hidden in the background without the affected person knowing, so a phone that seems normal proves nothing either way. The checks below look for what stalkerware cannot easily hide: switched-off protections, unfamiliar apps and accounts, and devices you did not add.

How to check an Android phone

Check Play Protect is on, then scan. Open the Google Play Store app, tap your profile icon at the top right, and open Play Protect and its settings. Google says Play Protect is on by default and recommends keeping it on, so finding Scan apps with Play Protect switched off when you never turned it off is a warning sign in itself: the EFF reports that stalkerware installation instructions often include disabling Play Protect.
Go through your installed apps. AV-Comparatives notes that Android's settings show each installed app's download source, version, notification settings, permissions and resource use, and that the Permission Manager lets you review and change what each app can access. Look for apps you do not recognise or remember installing, and for apps from outside Google Play that you did not add.
Ask whether the phone has been rooted. Some apps check whether a phone has been rooted. The NCSC says that is not a guarantee of hacking, but if an app reports it and you never rooted the phone yourself, it can be a good indication.
Get a second opinion from an app that detects stalkerware. In the 2025 test by the EFF and AV-Comparatives, Malwarebytes detected all 17 stalkerware products tested; Bitdefender, ESET, McAfee and Kaspersky each missed one; Google Play Protect caught 53% and Trend Micro 59%. Our best antivirus for Android compares those apps on the 2026 lab results.
On Android 16 or later, consider Intrusion Logging. The Coalition explains that this optional part of Android's Advanced Protection Mode keeps a record of activity such as app installations that cannot be wiped from the device. It only works from the moment it is switched on and cannot detect anything retroactively, and it is most useful with someone giving you direct technical support.

How to check an iPhone

Run Safety Check. On an iPhone with iOS 16 or later, go to Settings, then Privacy and Security, then Safety Check. It needs an Apple Account that uses two-factor authentication. Emergency Reset immediately stops sharing with all people and apps and walks you through your devices, trusted phone numbers and Apple Account password; Manage Sharing and Access lets you review people and apps one by one. A Quick Exit button closes Settings at once if someone walks in, and changes made before that are saved.
Review the devices signed in to your Apple Account. Go to Settings, then your name, then Devices, and remove any device you do not recognise.
Check Face ID and Touch ID for an appearance or fingerprint you did not set up.
Review your apps for any you do not recognise or remember installing.
Look for an unknown configuration profile. Apple says device management (MDM) profiles are typically installed by employers, schools or other official organisations, so one you cannot account for deserves attention.
Check whether iPhone Mirroring is set up, and revoke access if you did not set it up.
Change your passcode and your Apple Account password once you are ready, as Safety Check and Apple's checklist suggest.

If you could be a target of mercenary spyware

Apple says the vast majority of users will never be targeted by mercenary spyware. For the few who are, it sends Apple threat notifications: an alert on the iPhone Lock Screen and in Settings, an email from threat-notifications@email.apple.com, and a banner at the top of account.apple.com after you sign in. Apple has sent them multiple times a year since 2021, to users in over 150 countries. A genuine notification never asks you to click links, open files, install apps or profiles, or give your Apple Account password or a verification code, and you can confirm one by signing in at account.apple.com.

Apple recommends that notified users turn on Lockdown Mode and get expert help, and points to the Digital Security Helpline run by the nonprofit Access Now, available 24 hours a day. Lockdown Mode is available on iOS 16 and later. It is deliberately restrictive: most message attachment types are blocked, some complex web technologies are switched off, FaceTime calls from people you have not called in the past 30 days are blocked, and configuration profiles cannot be installed. Apple describes it as an optional, extreme protection for the very few people who might be personally targeted, so it is not something most readers need.

Removing spyware, and what to do afterwards

Plan first if a person is involved. See the safety section above before you remove an app or reset the phone.
A factory reset is the safest fix. The NCSC says phones and tablets usually cannot be fixed by an antivirus product in the way computers can, and that the safest solution is a factory reset. If that does not fix the problem, it says you will need expert help. Our guide to wiping a phone covers the reset itself.
Secure your accounts from a clean device. Apple's advice for everyone is to keep devices updated, use two-factor authentication and a strong password for your Apple Account, and use strong, unique passwords elsewhere. Our guides to creating a strong password and two-factor authentication cover both.
Check for physical trackers too. The EFF suggests that cheap Bluetooth trackers such as AirTags and Tiles may now be taking some of the market stalkerware used to have. How to find hidden trackers and cameras covers the alerts your phone already gives you.

For the same problem on a computer, see how to tell if your PC has malware and our comparison of malware scanners.

The short version

On Android, make sure Play Protect is still on, scan, review your apps and permissions, and run a second scan with an app that has a strong stalkerware record. On an iPhone, run Safety Check, remove unknown devices, apps and profiles, and change your passcode and Apple Account password. If someone close to you may be behind it, use a safe device to get support before you change anything. A factory reset is the cleanest way to remove spyware from a phone, and Lockdown Mode is for the rare person Apple warns directly. This is general guidance, not a substitute for specialist support.

Frequently Asked Questions

How can I tell if there is spyware on my phone?

Symptoms are unreliable because stalkerware is built to run hidden. Check instead: on Android, whether Play Protect has been switched off and what apps and permissions are installed; on an iPhone, Safety Check, the devices on your Apple Account and any configuration profiles. A security app with a strong stalkerware record gives a second opinion.

Can someone put spyware on my phone without touching it?

For ordinary stalkerware this is unlikely. The Coalition Against Stalkerware says Android almost always requires the person to have physical access to the unlocked device. Remote mercenary spyware exists, but Apple says it costs millions of dollars and targets a very small number of people.

Does a factory reset remove spyware?

The NCSC says a factory reset is the safest solution for an infected phone or tablet, and that you will need expert help if it does not fix the problem. If someone close to you may have installed the spyware, plan with a support service before resetting.

Which app is best at finding stalkerware?

In the 2025 test by the EFF and AV-Comparatives, Malwarebytes detected all 17 stalkerware products. ESET, Bitdefender, McAfee and Kaspersky each missed one, Trend Micro caught 59% and Google Play Protect 53%.

Should I turn on Lockdown Mode?

Only if you have reason to think you are personally targeted, for example after an Apple threat notification. Apple describes Lockdown Mode as an optional, extreme protection for the very few people targeted by sophisticated attacks; it blocks most message attachments and limits several features.

Is it safe to remove stalkerware once I find it?

Think about safety first. The Coalition Against Stalkerware warns that someone monitoring your device can see your searches for help, so use a device they have never had access to, and Apple advises considering the impact on your safety before changing or deleting anything. A support organisation can help you plan.

Affiliate disclosure

This article contains affiliate links. If you purchase through them, CyberTechVault earns a commission at no extra cost to you. Our assessments are based on vendors' published documentation, independent lab results and security disclosures — not on hands-on testing by us. Affiliate relationships never decide what we recommend.

Full disclosure: /affiliate-disclosure.

Sources

Factual claims above were checked against these primary sources. Verify directly on the source for anything time-sensitive before relying on it.

Continue reading

antivirus

Continue in this collection

Best Security Tools

The shortlist across antivirus, VPN and password managers, and the reasoning.

Explore

Live Offers

What is actually discounted right now, rather than what once was.