How to Check If Your Android Phone Is Hacked — and What to Do Next (2026 Guide)

Most "hacked phone" worries turn out to have a boring explanation: a runaway app draining the battery, a misbehaving update, or a forgotten setting. But real phone compromises do happen, usually through a malicious app, a phishing link, or a fake app installed outside the Play Store. The trick is knowing how to tell the difference — and what to do, calmly and in the right order, if something really is wrong. This guide walks you through the warning signs, the checks you can run yourself in about 20 minutes, and the safe cleanup steps that fix most problems without losing your photos or contacts.

Warning Signs That Deserve a Closer Look

No single symptom proves a hack. Look for a pattern — two or three of these together are worth investigating:

• Battery draining much faster than usual, with the phone warm even when you are not using it. A hidden background process can do this, but so can a failing battery or a buggy update, so check the battery usage screen before concluding anything.
• Mobile data usage jumping sharply without a change in how you use the phone. Go to Settings → Network & internet → SIMs (or Data usage) and see which app used the data.
• Apps you did not install, new browser home pages, or pop-up ads appearing on the home screen or over other apps.
• Settings changing by themselves — for example, a new device administrator, accessibility services you did not turn on, or unknown apps given permission to draw over other apps.
• Messages, posts or emails sent from your accounts that you did not send, or friends telling you they received strange links from you.
• Your phone behaving oddly during calls, such as apps opening on their own, or the screen turning on repeatedly while idle.

One sign on its own is usually not a hack. A new symptom that started right after you installed an app from outside the Play Store, tapped a link in a suspicious message, or granted an app unusual permissions is a much stronger clue.

Step 1: Check Battery and Data Usage

Open Settings → Battery → Battery usage and look at the last 24 hours. A legitimate app you use heavily — video, maps, games — will naturally sit near the top. What you are looking for is an app you barely use, or do not recognise, consuming a large share of battery in the background. Tap it and check whether it has been running in the background for hours.

Do the same for data: Settings → Network & internet → Data usage (the exact path varies slightly by brand). An unknown app uploading large amounts of data in the background deserves a closer look. If you find one, do not open it again — note its name, then move to the removal steps below.

Step 2: Review Every Installed App

Open Settings → Apps → See all apps and scroll the whole list slowly. Look for apps you do not remember installing, apps with generic names and no icon, or duplicates of apps you already have. Malicious apps sometimes hide behind bland names like "System Update", "Phone Cleaner" or "Free VPN".

Also check the Play Store: open Play Store → your profile picture → Manage apps & device → Manage, and sort by "Recently updated" or "Least used". An app installed recently that you do not recognise is a prime suspect. If an app refuses to uninstall normally — the Uninstall button is greyed out — it may have made itself a device administrator, which brings us to the next check.

Step 3: Check Device Admin Apps and Accessibility Services

Device administrator status is powerful: it can stop an app being uninstalled and let it lock your screen or wipe data. To check, go to Settings → Security → Device admin apps (on Samsung: Settings → Biometrics and security → Other security settings → Device admin apps). The only entries you should normally see are trusted ones such as Find My Device. If an unknown app is listed, turn its admin access off first, then uninstall it.

Next, check accessibility services: Settings → Accessibility. Accessibility services can read your screen and tap buttons for you, which is why legitimate apps like screen readers need them — and why a malicious app wants them. If a service is turned on for an app you do not trust or do not need, turn it off. Do the same for apps allowed to "display over other apps" (Settings → Apps → Special app access → Display over other apps): pop-up ads over your home screen almost always come from an app with this permission.

Step 4: Check Your Google Account and Sessions

Even if your phone itself is clean, your accounts may not be. On any trusted device, open your Google account security page (myaccount.google.com → Security) and check:

• Your devices: every phone, tablet and computer signed in to your Google account. Remove any device you do not recognise or no longer own.
• Recent security activity: sign-ins from places or devices you do not recognise.
• Third-party access: apps and services connected to your Google account. Remove anything you do not use or do not recognise.

Repeat the same quick check for your most important accounts — email, WhatsApp, Facebook, and your bank app — looking for unknown sessions or devices. If you find an unknown session, sign it out from the account's security settings, then change that account's password from a trusted device, and turn on two-factor authentication if it is not already on.

Step 5: Safe Cleanup (Before Considering a Factory Reset)

Work through these in order. Most problems are fixed by step 3:

1. Uninstall suspicious apps — starting with anything you do not recognise, anything installed recently from outside the Play Store, and anything that asked for admin or accessibility access.
2. Clear the browser: in Chrome, go to Settings → Privacy and security → Delete browsing data, and clear cached images, cookies and site data. Also check Chrome's notification permissions and remove any site you do not recognise.
3. Turn off "Install unknown apps" for every app: Settings → Apps → Special app access → Install unknown apps. Browsers and file managers often have this on by default after a single install — turn it off for all of them.
4. Run Google Play Protect: Play Store → profile picture → Play Protect → Scan. It checks your installed apps against known harmful ones.
5. Change your passwords for your Google account and any account that showed strange activity, using a trusted device and a strong, unique password for each. A password manager makes this far easier than reusing one password everywhere.
6. Restart in Safe Mode if problems persist: press and hold the power button, then press and hold "Power off" until "Reboot to safe mode" appears. In Safe Mode only system apps run, so if the strange behaviour stops, a third-party app is the cause. Restart normally to exit Safe Mode, then uninstall apps one by one, newest first, until the behaviour stops.

When a Factory Reset Is the Right Call

If suspicious apps keep coming back, the phone still misbehaves in Safe Mode, or you have strong reason to believe a serious compromise happened, a factory reset is the cleanest fix. It wipes all apps and data from the phone, which is why the backup step matters:

• Back up photos, contacts and important files to Google Photos and Google Drive first, and confirm the backup is complete before resetting.
• Write down (on paper, or on another device) any two-factor backup codes and account details you will need to sign back in.
• Go to Settings → System → Reset options → Erase all data (factory reset), confirm, and let the phone restart.
• After the reset, sign in with your Google account, restore only the backup, and reinstall apps from the Play Store only — do not restore an unknown APK or reinstall the suspicious app.

A factory reset is a last resort, not a first step. It costs time, and if you restore the same malicious app afterwards, the problem returns. Do the checks and cleanup above first, and reset only if they do not resolve the issue.

Prevention: Habits That Stop It Happening Again

• Install apps from the Play Store only, and read the permissions an app requests before accepting them. A simple app asking for contacts, SMS and accessibility access is a red flag.
• Keep Play Protect on and keep your phone's system and apps updated — updates close security holes that malicious apps exploit.
• Never tap links in unexpected messages claiming your account will be closed, a parcel is waiting, or you have won a prize. Open the app or site directly instead.
• Use a screen lock, and turn on Find My Device, so a lost phone can be located, locked or erased remotely.
• Use unique passwords and two-factor authentication on your Google account and every important service. That way, even if one password leaks, the attacker still cannot get in.
• Review app permissions every few months: Settings → Privacy → Permission manager shows which apps can access your location, camera, microphone and files. Revoke anything that no longer needs it.

Frequently Asked Questions

Can someone hack my phone just by knowing my number?

Knowing a phone number alone is not enough to take over a modern Android phone. Real compromises almost always need you to install something, tap a malicious link, or hand over a code or password. That is why phishing messages — not phone numbers — are the usual way in.

Does a factory reset remove all malware?

A factory reset removes apps and data from the phone's user storage, which covers the overwhelming majority of malicious apps. It does not change your account passwords, so if an attacker already has a password, change it separately after the reset.

Should I install an antivirus app?

For most users, Google Play Protect plus careful app choices is enough. A third-party antivirus can help if you regularly install apps from outside the Play Store — but only install a well-known one from the Play Store itself, and be wary of free "cleaner" apps that demand broad permissions.

What if my bank account was affected?

Contact your bank immediately, before doing anything else on the phone. Banks can freeze transactions and issue new cards faster than any cleanup step you can do yourself. Then change your banking password from a trusted device.

If you work through the checks above and find nothing suspicious, that is good news, not a wasted exercise: you have confirmed your phone is clean, tightened your permissions, and made a future compromise much harder. And if you do find a problem, you now know exactly what to remove, what to change, and when a reset is justified — without panic, and without losing anything that matters.