7 Signs Your Phone Has Spyware Right Now

Spyware doesn't announce itself. That's the point. Whether it's a jealous partner, a malicious ex, or a threat actor who briefly had access to your device, the software is engineered to run silently in the background — reading your messages, tracking your location, and recording your calls without leaving an obvious trace.

But no software is truly invisible. Here are seven signs that something may be running on your device that you didn't put there.

This is one of the most consistent early indicators. Spyware runs continuously in the background — monitoring activity, packaging data, and transmitting it to a remote server. All of that takes power.

If your battery life has dropped significantly without a change in your usage habits, and you haven't recently updated your operating system or installed new apps, it's worth investigating further.

What to check: Go to your battery usage settings and look for apps consuming power in the background that you don't recognise or rarely use.

A phone that gets warm while you're actively using it is normal. A phone that gets warm while it's sitting face-down on a table is not.

Persistent background processes — like those used by spyware to transmit data — generate heat. If your device regularly feels warm when it should be idle, that's a signal worth taking seriously.

Spyware has to send the data it collects somewhere. That transmission uses your mobile data or Wi-Fi connection. If you notice your monthly data usage has increased without a corresponding change in how you use your phone, background data exfiltration is a plausible explanation.

What to check: Review your data usage by app in your phone's settings. Look for apps using data in the background that you don't recognise.

Some older or less sophisticated spyware tools cause audible artefacts during phone calls — faint clicking sounds, brief echoes, or unusual static. More advanced tools don't produce these symptoms, but if you're noticing them consistently, it's worth noting.

More reliably: if your screen lights up, your phone restarts, or you notice activity during calls that you didn't initiate, that warrants investigation.

Spyware is sometimes installed as a standalone app — often disguised as a utility, system tool, or something with a generic name like "Phone Monitor" or "System Service."

What to check: Review every app installed on your device. If you see something you don't remember installing, or something with an unusually generic name and no clear purpose, don't dismiss it.

On Android, also check your list of apps with Device Administrator privileges. Spyware often requests this permission to prevent easy removal.

When you power off your phone, it terminates all running processes. If a background process — like spyware — is actively transmitting data, the shutdown sequence may take noticeably longer than usual as the OS waits for processes to close.

This isn't a definitive indicator on its own, but combined with other signs, it adds to the picture.

This is the most human indicator, and often the one that brings people to us. If someone in your life consistently knows details about your conversations, your location, or your plans that you haven't shared with them — that's not a coincidence. That's a pattern.

Trust your instincts. If something feels wrong, it's worth investigating.

The worst thing you can do is immediately factory reset your device. That destroys the forensic evidence needed to confirm what was installed, when, and by whom — evidence that may be critical if you need to take legal action. If you suspect your device has been compromised, a full device forensic analysis preserves that evidence before it's gone.

The right steps:

1. Don't alert the person you suspect. If they know you're investigating, they may remotely wipe the spyware before it can be documented.
2. Stop using the device for sensitive communications until it's been examined.
3. Document what you're observing — screenshots, dates, specific behaviours.
4. Get a professional forensic review. A trained analyst can image your device, identify the software, establish a timeline, and produce a report that holds up to scrutiny. Our stalkerware and spyware investigation service is designed exactly for this.

Spyware cases are time-sensitive. Evidence degrades. If you recognise these signs, act quickly — but act carefully.