10 Ways to Tell if Your Android Phone Is Hacked

How to Tell If Your Android Phone Is Hacked

1. Battery draining too quickly or getting hot

A battery that’s suddenly draining faster than usual — or a phone that feels warm even when you’re not using it — can be easy to dismiss. But it’s worth paying attention to.

Threats like spyware can run constantly in the background, quietly collecting and transmitting data from your device. That continuous activity puts a heavy load on your processor, which burns through battery life and generates heat.

That said, battery drain isn’t always a red flag. Older phones naturally hold less charge over time, and some apps are just power-hungry. If the change has been sudden, or if your phone is also showing other signs from this list, that’s when it becomes more concerning.

Here’s how to check which apps are using the most battery on your device:

1. Open the Settings app.
2. Tap Battery.
3. You’ll see a breakdown of battery usage by app. If an app you don’t recognize is using a lot of battery, that’s worth investigating.

Fig 1. Checking battery usage by app on Android.

2. Google Play Protect has been disabled

Google Play Protect is a built-in security tool available on all modern Android devices. It works by scanning every app for malware the moment it’s installed.

Hackers will often disable Play Protect when they are trying to compromise a phone or tablet. If it’s turned off on your device, that’s a major red flag.

For security, we recommend that you always keep Google Play Protect on. Here’s how to check your Google Play Protect settings:

1. Open the Google Play Store app.
2. Tap the profile icon at the top right of your screen.
3. Tap Play Protect.
4. If Play Protect is turned off, this could be a sign that someone has disabled it in order to install a malicious app.

Fig 2. Enabling Play Protect on Android.

3. Unknown apps with elevated permissions

Most apps only need basic permissions to work — access to your camera for photos, or your location for maps. But malware often requests far more than it needs, specifically to gain deeper control over your device.

Two permissions in particular are worth checking:

• Accessibility permission — Designed to help users with disabilities, this permission can be abused by malware to draw over the screen and display fake login pages, potentially stealing your passwords without you even realizing.
• Device admin permission — This is a high-level permission that, if granted to a malicious app, can actually prevent it from being uninstalled, making it much harder to remove the threat.

How to check Accessibility permissions:

1. Open Settings.
2. Tap Accessibility.
3. Tap Installed Apps.
4. Review any apps listed here. If you don’t recognize one, revoke its access immediately.

Fig 3. Checking Accessibility permissions on Android

How to check Device Admin permissions:

1. Open Settings.
2. Tap Security & Privacy.
3. Tap More security settings.
4. Tap Device Admin Apps.
5. If an unfamiliar app has admin access, deactivate it and then uninstall it.

Fig 4. Checking Device Admin permissions on Android.

4. Camera or microphone indicator activating unexpectedly

Most Android phones (Android 12+) show a green dot in the top-right corner when an app is using the camera or microphone. If this light appears when you’re not using the camera or making a call, it could indicate a malicious app is accessing these sensors in the background.

On some Android phones, you can swipe down from the top of the screen to see the name of the app currently using your camera or microphone.

On others, you can get a more detailed log of all access in the last 24 hours.

1. Open Settings.
2. Tap Security and privacy.
3. Under Permissions used in the last 24 hours, tap Camera or Microphone.

Fig 5. Checking microphone usage history

5. Suspicious apps

If you think your phone has been compromised, one of the first things to check is your app list — specifically, anything you don’t remember installing.

Spyware and malicious software almost always require an app to be present on the device to do their work.

On Android, this can happen in a few ways: someone with brief physical access to your phone can install something directly, but users can also be tricked into installing malware yourself — through a fake app, a malicious download link, or an APK file from outside the Google Play Store.

Either way, the app is often designed to blend in. It might have a generic name, a blank icon, or disguise itself as a system utility.

Here’s how to review all installed apps on Android:

1. Open Settings.
2. Tap Apps.
3. Scroll through the full list and look for anything suspicious.

Fig 6. Finding a suspicious app on Android.

6. Unusually high data usage

Malware doesn’t just sit quietly on your device — it often sends data back to whoever installed it. That means calls, messages, photos, and location data are all being transmitted in the background, often without any obvious signs. However, all this still contributes to your data usage.

If your monthly usage has spiked without any clear reason, it’s worth digging into which apps are responsible.

How to check data usage on Android:

1. Open Settings.
2. Tap Connections
3. Tap Data Usage.
4. Here you can choose between Mobile and Wi-Fi data usage to see a full breakdown by app.
5. Look for anything using an unusually high amount of data — especially apps you don’t recognize or rarely use.

Fig 7. Checking data usage by app on Android.

Keep in mind that high data usage isn’t always sinister — a streaming app left running or a large update downloading in the background can both cause spikes. But if you can’t explain the usage, it’s worth investigating further.

7. Developer options are enabled

Developer Options is a hidden menu built into Android, designed for app developers to test and debug their work. Most everyday users will never need it, which is exactly why finding it switched on unexpectedly is a red flag.

With Developer Options enabled, someone could connect your phone to a computer and silently install apps that bypass the normal security checks. It’s a technique commonly used to deploy spyware without leaving an obvious trace.

How to check if Developer Options is enabled:

1. Open the Settings app.
2. Tap the search bar and type “Developer“.
3. If Developer Options appears as a result and is turned on, tap it and toggle it off.

Fig 8. Checking if Developer Options is enabled on Android.

8. Antivirus finds a threat on your device

Sometimes the clearest answer is the most direct one — running a dedicated malware scan on your device.

Manually checking settings and apps can help you spot warning signs, but it won’t always catch everything. Sophisticated spyware is specifically designed to avoid detection, hiding behind generic app names or disguising itself as a system process. An antivirus app looks deeper than a manual check ever could.

Certo AntiSpy is free to download and will give you a clear picture of what’s actually on your device. Here’s what it checks for:

• Hidden spyware and malicious apps.
• Security vulnerabilities in your device settings.
• Unauthorized access attempts when your phone is left unattended.
• Accounts or passwords exposed in a data breach.
• Apps with access to your sensitive data.

Fig 9. Detecting a threat with Certo AntiSpy.

9. Unexpected ads or pop-ups

If you’re encountering unexpected ads or pop-ups on your Android device, it could be a sign of adware or malware. These ads may appear as notifications, on your home screen, or within apps, often claiming that your device is infected and urging you to download a fake security tool.

To check for this, observe if the ads appear while using specific apps or across various applications. If you’re unsure of the source, try restarting your device in Safe Mode. This mode will temporarily disable all third-party apps. If the popups stop appearing, then you know that an app is the cause.

Here is how to activate safe mode:

1. Press and hold the power button.
2. Long-press the Power Off option until the Safe Mode prompt appears.
3. On the following warning screen, tap the icon once more to proceed. Your phone will then reboot into Safe Mode.

How to exit safe mode:

1. Simply restart your device.
2. Alternatively, use the notification panel: select Safe Mode is on and then tap Turn off.

Fig 10. Example popup and enabling safe mode on Android.

10. Your device is rooted

Rooting is a way of gaining access to deeper levels of authority over the device, and it is not usually allowed by the hardware or software developers.

Android rooting requires some basic technical knowledge. While it’s easy enough to do for someone with the right ability, it’s not something you can do to your own device by accident.

Hackers may seek to root your device to get easier access to certain functions on your cell phone and facilitate advanced spyware use. According to Certo’s 2025 data, 0.28% of Android devices were rooted — double the rate seen in 2023 — suggesting this attack vector is growing.

If your device is rooted and it wasn’t you or someone you authorized who rooted it, your phone is likely hacked.

Fig 11. Data showing the growth of Android rooting.

What To Do If Your Android Phone Has Been Hacked

If you’ve spotted one or more of the signs above, don’t panic — but do act quickly. The longer malware stays on your device, the more of your personal data it can access and transmit. Here’s what to do:

1. Disconnect from the internet. Turn off Wi-Fi, mobile data, and Bluetooth to stop any active data transmission.
2. Run a security scan. Use Certo AntiSpy to safely remove any malicious apps or files embedded on your device.
3. Change your critical passwords. Start with your Google account, then email, banking, and social media. Don’t use the compromised phone to do this.
4. Revoke suspicious app permissions. Go to Settings > Security & Privacy > Permission Manager. Look for unknown apps with access to your camera, microphone, location, or storage.
5. Remove any apps you don’t recognize. Uninstall anything you don’t remember downloading. Note that Android includes pre-installed system apps that may look unfamiliar — focus on anything with a vague name or no clear purpose.
6. Check for unauthorized linked accounts or devices. Go to Settings > Google > Manage your Google Account > Security > Your devices and remove anything unfamiliar.
7. Enable two-factor authentication on all key accounts using an authenticator app (not SMS, which can be intercepted).
8. Consider a factory reset if threats persist. Back up your data first and restore only from a trusted backup taken before you noticed the issue.

Wrapping Up

Phone hacking isn’t always the work of a distant, anonymous attacker. In many cases, it’s someone the victim already knows — and that makes it a lot harder to deal with than any technical fix.

If something feels off about your device, take it seriously. Your instincts are often right.

If you’re concerned that someone close to you may have installed spyware on your device, you’re not alone. Visit our support resources page for organizations that can help.

Frequently Asked Questions (FAQs)

Can someone hack my Android phone remotely?

Yes, in some cases — but it typically requires an initial action on your part, such as clicking a malicious link, downloading a compromised app, or connecting to an unsecured Wi-Fi network. Once that entry point is established, a hacker can potentially access your data, monitor your activity, or install spyware without any further physical access to your device.

The best way to reduce this risk is to avoid downloading apps from outside the Google Play Store, be cautious about the links you click, and run regular security scans using an app like Certo AntiSpy.

What are the signs of a hacked Android phone?

The most telling signs of a hacked Android phone include, unexplained data usage, rapid battery drain, unusual apps and Google Play Protect being disabled.

These signs, along with antivirus alerts, suggest unauthorized access to your device, possibly due to malicious software. Regularly check and maintain security features to safeguard your phone.

What is the first thing you do when you get hacked?

If your phone has been hacked, immediately disconnect it from the internet by turning off Wi-Fi, mobile data, and Bluetooth. Change your critical passwords, especially for accounts linked to your phone. Use a trusted antivirus app to scan and remove any malware. Update your phone’s software to fix security gaps.

If problems persist, consider a factory reset, but back up your data first. Keep an eye on your accounts for any unusual activity and inform relevant services about the breach.