Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesIf you think spyware may be on your phone, do not start with a factory reset or an argument. First decide whether a person who could harm you may be monitoring the device. Use a safer device to seek help, document what you can without being detected, and then choose the response for your situation: possible stalkerware, ordinary Android malware, or a work-related incident. Battery drain, overheating, unusual data use and other symptoms are clues, not proof.
What should I do if I think someone put spyware on my phone?
Follow this order:
- Put personal safety first. If a partner, former partner, family member or anyone with physical access could be monitoring you, do not confront them or begin changing settings on the suspected phone.
- Use a safer device to get advice. If possible, leave the suspected phone behind and contact a trusted person or a domestic-violence advocate from another phone or computer.
- Record what prompted the concern. Note dates, unusual behavior, information another person seemed to know, and who may have had unsupervised access.
- Preserve evidence if it is safe. A reset, replacement or cleanup tool can erase records that may matter for safety, employment or legal proceedings.
- Identify the threat context. Stalkerware, ordinary Android malware and a compromised work device require different handling.
- Secure accounts from a device the suspected person cannot access. Change passwords and enable two-factor authentication only after considering whether the change could alert or escalate the situation.
A clean scan or a new phone cannot prove that every account, cloud session or shared device is secure. Treat device cleanup and account security as separate tasks.
As an Amazon Associate I earn from qualifying purchases.
Could changing the phone make an abusive situation more dangerous?
Yes. When intimate-partner or family surveillance is possible, technical actions can reveal that you are investigating. The Federal Trade Commission warns: “Taking any of these steps could tip off your abuser — especially if you make a call, use your phone to research your options, or have a conversation near your phone.”
Recommended Free Tools
Do not use the suspected phone to search for help, call an advocate, change passwords or discuss the situation nearby if doing so could increase danger. A safer device might be a trusted friend’s phone, a library computer used privately, or another phone that the suspected person cannot access. Do not assume incognito or private browsing makes a monitored device safe.
#1 Best Overall
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
The FTC recommends speaking with a domestic-violence advocate before removing suspected stalkerware. An advocate can help you make a personal and technology safety plan and discuss preserving evidence. In the United States, the National Domestic Violence Hotline lists 1-800-799-SAFE (7233), text START to 88788, and thehotline.org. Verify contact details when you use them because hotline information can change. These resources are U.S.-based; readers elsewhere should use a local equivalent, and should not assume that contacting police or another authority is always the safest first step.
If you are in immediate danger, prioritize reaching a safe place and emergency help using a device that cannot be monitored. Do not delay leaving an unsafe situation to collect technical evidence.
Which symptoms are clues, and which ones prove spyware?
No symptom in this checklist proves spyware. Battery age, a defective charger, a software update, poor reception, a misbehaving app, normal background synchronization or a compromised online account can produce similar behavior. Use symptoms to decide what to document and investigate, not to diagnose an infection by themselves.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Battery draining faster than usual: note when the change began and whether it occurs during heavy use, poor reception or charging.
- Unexpected data use: check the dates and amounts, and record which service or app appears responsible if your phone shows that detail.
- Overheating: record whether the phone is hot while idle, charging, making a call or running a particular app.
- Unexpected restarts or shutdowns: note the time, battery level and what the phone was doing.
- Unfamiliar apps, settings or notifications: record names and take screenshots only if doing so is safe.
- Someone knows private information: write down specific location, conversation, message or browsing details they knew and when they appeared to know them.
Ask the FTC-style screening questions: Is the battery draining faster than usual? Are you unexpectedly using more data? Is the phone overheating? Does an abuser know your exact location when you have not told them where you are? These questions help establish a timeline; they are not diagnostic tests.
Rank #2
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
How do I document the concern without destroying evidence?
Make a contemporaneous record before resetting, replacing or aggressively cleaning the phone, but only when doing so will not increase risk. Use a safe account or device if the suspected phone may be watched.
- Write the date and time of each unusual event.
- Describe exactly what happened instead of labeling it “spyware.” For example, record “battery fell from 80% to 35% while idle for four hours.”
- Record unexpected access to messages, conversations, browsing history or location, including what the other person knew and when.
- Note who had unsupervised physical access to the phone, whether the passcode was known, and whether the device was shared.
- Keep screenshots, messages, photographs or notes in a location the suspected person cannot access. A separate trusted account or physical copy may be safer than cloud storage tied to the phone.
If evidence could matter in a safety, employment or legal matter, ask an advocate or qualified specialist what to preserve before changing the device. A visible attempt to investigate may alert someone monitoring you, and a factory reset can remove useful records.
Which response path fits my situation?
| Situation | Safest first move | Why the sequence matters | Next step |
|---|---|---|---|
| Possible intimate-partner or family surveillance | Use a safer device to contact an advocate or trusted support person; avoid confronting the suspected person. | Changing settings, researching or calling from the phone may reveal your plan or escalate abuse. | Create a personal and technology safety plan; preserve evidence when safe, then decide whether to reset or replace. |
| Possible ordinary Android malware, with no personal-safety concern | Install Android and security updates, remove untrusted apps and review Google Account security. | These are Google’s baseline consumer steps and do not require assuming that spyware is present. | Run Play Protect checks. If signs persist, follow current manufacturer guidance about a reset or technical support. |
| Work-managed device or suspected organizational compromise | Contact your organization’s security or IT incident-response team through a separate trusted channel. | Isolation and evidence collection can conflict; powering off, disconnecting or running tools may alter volatile evidence. | Let the organization or qualified responder decide containment, logging and forensic collection. |
| Evidence may be needed for a legal or employment matter | Consult an advocate, attorney or qualified forensic specialist before altering the phone. | Resetting or replacing can destroy records, while leaving a compromised device active can expose more information. | Follow the specialist’s documented preservation and safety plan. |
What should I do if I suspect ordinary Android malware?
If no one who might harm you is monitoring the phone and the issue looks like ordinary malware, Google’s consumer guidance provides a practical baseline. Use the exact labels shown on your current Android version; menu names can differ by manufacturer.
- Install pending updates. Open the phone’s system settings and check for Android system updates. Also install available security updates. Update only through the device’s normal settings or the official app store, not through a link in an unexpected message.
- Review installed apps. In settings, open the app list and look for software you do not recognize, no longer need or did not intentionally install. Remove apps that are not trusted. If an app is required for work or a family safety arrangement, confirm its purpose before deleting it.
- Run Google Play Protect. Play Protect checks apps and devices for harmful behavior. Depending on what it finds, it may warn you, deactivate an app or remove it. A clean result is useful but does not establish that the phone is free of every form of spyware.
- Review Google Account security. From a safer device when possible, inspect recent security activity, signed-in devices, recovery options and third-party access. Remove sessions or access you do not recognize, but consider whether doing so could alert an abusive person.
- Recheck the original symptoms. After updates and removal of an untrusted app, observe whether the battery, data use, overheating or restart problem changes. Keep the timeline rather than assuming improvement proves the diagnosis.
- Escalate if signs persist. Google identifies a device reset or help from the manufacturer as possible next steps. Follow current instructions for your exact model and back up only material you trust.
Do not treat an antivirus scan, Play Protect result or a single missing app as a definitive forensic finding. Sophisticated spyware, account compromise and legitimate device-management software may not present as a simple harmful app.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download] | Includes Scam Protection, Advanced VPN, Dark Web Monitoring, & PC Cloud Backup](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
When is a factory reset or a new phone appropriate?
A reset or replacement is an option, not a universal first step. Decide using four questions: could the action alert someone who may escalate abuse, could it destroy evidence, does the threat look like consumer malware or an organizational incident, and are your email, cloud, social or financial accounts also exposed?
If stalkerware is possible
The FTC says a factory reset may remove stalkerware when you must keep the phone. In some situations, obtaining a new phone with an account the suspected abuser cannot access may be safer. Neither option is required for everyone, and neither automatically secures accounts or shared access.
Before either action, consult an advocate if it is safe and preserve relevant evidence. If you reset the phone, do not restore apps from the old phone’s backup when stalkerware is a concern; that backup could reinstall it. Reinstall needed apps from the official app store instead, and review every permission before granting it.
If Android malware is suspected without an interpersonal-safety risk
Google also lists resetting the device or asking the manufacturer for help when symptoms continue after updates and app review. Use the current instructions for the exact manufacturer and model. Keep records of important files first, but do not restore an untrusted app set merely for convenience.
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
If evidence or a work investigation matters
Do not reset or replace the device on your own. CISA organizational guidance emphasizes isolating affected systems and collecting logs and artifacts, including memory and forensic images, before mitigations when feasible. Its compromise guidance also cautions that powering off, disconnecting or running tools can alter or destroy volatile evidence. A qualified responder must weigh evidence preservation against the continuing risk of exposure.
If the phone is an iPhone
This checklist does not provide detailed iOS menu paths. Use current Apple Support instructions for your model and operating-system version, or obtain help from a qualified specialist. Do not assume that Android steps, app behavior or backup handling maps directly to iOS.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I secure accounts after suspected spyware?
Device cleanup does not undo access to an email, cloud, social, financial or messaging account. From a device and network the suspected person cannot access:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- Create strong, unique new passwords for accounts the person may know or use.
- Turn on two-factor authentication using a method the suspected person cannot control. Consider whether text messages are safe if the person can access your phone plan or messages.
- Review active sessions, signed-in devices, recovery email addresses, recovery phone numbers and third-party app access.
- Check location sharing, family or household groups, shared calendars, cloud photo access and other services that can reveal where you are or what you are doing.
- Update the password for the primary email account first when safe, because email often controls password resets for other services.
Account changes can themselves reveal that access is being cut off. If you face abuse or stalking, make these changes as part of a safety plan rather than treating password changes as a substitute for one.
Best Value
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
What is different about a work-managed device?
A company phone or laptop may contain management software that is legitimate, required and visible to the organization. If you suspect a serious breach, contact security or IT through a separate trusted channel and explain what you observed without deleting files or installing cleanup tools.
CISA’s organizational response approach centers on containment and evidence collection. Responders may isolate affected systems, gather logs and artifacts, capture memory or forensic images and involve a qualified third-party incident-response provider. Those steps are designed for organizations and are not blanket instructions for someone facing intimate-partner surveillance. On a personal phone, powering off or disconnecting can also change evidence and may remove the only way to communicate safely. Let the appropriate responder decide the sequence.
Common mistakes that make the situation worse
- Confronting the suspected person first: this can escalate abuse and may prompt them to destroy evidence or increase monitoring.
- Resetting immediately: a reset can erase evidence and does not secure exposed accounts.
- Restoring every old backup: an app backup can reinstall stalkerware or reintroduce an unsafe configuration.
- Assuming a new phone solves everything: shared accounts, location services and cloud sessions can continue exposing information.
- Installing a random “spyware remover”: untrusted tools can add risk, alter evidence or produce false confidence.
- Treating symptoms as proof: heat, battery drain, data use and restarts have many non-malicious causes.
- Using the monitored phone to seek help: searches, calls and conversations near it may be visible to the person you fear.
- Applying corporate-forensics advice to a personal safety crisis: organizational containment procedures may not be safe for an individual facing abuse.
When should I get specialist help?
Seek specialist advice before changing the device when a person may retaliate, when you need evidence for court or employment, when the phone is managed by an organization, or when symptoms continue after ordinary Android steps. A domestic-violence advocate can help with safety planning; an organization’s incident-response team can handle work devices; and a qualified digital-forensics professional can advise on preservation. Choose the helper through a safer device and explain that the phone may be monitored.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →The practical endpoint is not merely “the phone looks normal.” It is a documented, safe plan that addresses the device, accounts, backups, shared access and any evidence you may need. If the situation is personal surveillance, safety planning comes first; if it is ordinary Android malware, use updates, trusted-app review, Play Protect and manufacturer guidance; if it is organizational, let trained responders control isolation and evidence handling.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
