Most phones that feel wrong are just tired: an ageing battery, a bloated app, a background sync that never ends. Monitoring is far rarer than the internet suggests. It does happen, though, and it leaves traces — so rather than guessing, work through the signs that can actually be verified and ignore the ones that cannot.
The signs that are worth taking seriously
Battery drain that started suddenly. Not gradual decline over two years, but a phone that went from a full day to half a day within a week, with no new apps and no OS update. Monitoring software records and uploads, and that costs power.
Heat when idle. A phone that is warm in your pocket while doing nothing is running something. Check which app is responsible before drawing conclusions — cloud backup and photo sync are the usual culprits.
Mobile data used by something you do not recognise. In Android settings, data usage is listed per app. An unfamiliar system-sounding name consuming hundreds of megabytes is the single most useful signal on this list.
Someone knows things they should not. Details from a private message, a location you did not share, a plan discussed only in one room. This is soft evidence, but in practice it is what prompts most genuine discoveries.
Device admin apps you did not install. Monitoring tools need elevated permissions to survive. Settings → Security → Device admin apps shows everything holding them.
The signs that mean almost nothing
Clicks on calls, brief echoes, the phone lighting up on its own, slow shutdown, unexpected reboots, ads that seem to follow a conversation. Every one of these has a mundane explanation that is overwhelmingly more likely: network handover, a scheduled update, ad retargeting from your browsing rather than your microphone. Treating them as proof leads people to reinstall their life around a fault that was never there.
How to check your Android phone, in order
- Settings → Apps → see all apps. Read the full list, not the home screen. Anything you cannot account for, search the exact name before removing it.
- Settings → Security → Device admin apps. Revoke admin rights from anything unfamiliar. Monitoring tools usually cannot be uninstalled until you do.
- Settings → Apps → Special app access → Usage access and Accessibility. These two permissions are what monitoring software relies on to read screen content. Very few legitimate apps need either.
- Settings → Network → Data usage. Sort by usage and look at the last 30 days.
- Google account security check. Review signed-in devices and remove any you do not recognise, then change the password from a different device.
- Update the operating system. Many monitoring tools depend on unpatched flaws and simply stop working after an update.
If all six come back clean, a factory reset settles the question completely. Back up photos and documents manually rather than restoring a full system backup, which can carry the problem back with it.
What none of this covers
Everything above concerns software on the handset. Interception at the network level — a device impersonating a cell tower to capture identity, location and call metadata — leaves no trace in your settings at all, because nothing is installed on the phone. Detecting that requires hardware that monitors the baseband and flags an implausible tower. That is the gap purpose-built secure handsets such as CIPHER are designed to close, alongside encrypted call and message channels.
What to do if you find something
Do not delete it immediately if the situation may become a legal matter — screenshots of the app, its permissions and its data usage are worth more than a clean phone. Then change passwords from a different device, enable two-factor authentication on your email first, and remove the software.
If the person who had physical access to your phone also has access to your home or your car, treat the phone as one part of a wider check rather than the whole of it. Our guides on telling whether your house is bugged and finding a GPS tracker on your car cover the rest.