Consumers can identify, remove, and prevent mobile spyware using guidance from TechSafety, Tech Safety Canada, Mac Sources, Tech Journal, and the National Network to End Domestic Violence

According to guidance from TechSafety, Tech Safety Canada, Mac Sources, Tech Journal, and the National Network to End Domestic Violence, consumers can identify, remove, and prevent mobile spyware by following these steps:

Mobile spyware also called stalkerware is software secretly installed on a phone to monitor calls text messages contacts browsing history location photos and email without the owner’s consent. It is frequently used in intimate‑partner violence to monitor victims’ communications and location.

Typical indicators of possible spyware include fast battery drain device overheating unexplained spikes in mobile data usage sluggish performance and the appearance of unfamiliar or generically named apps such as “System Update” or “Wi‑Fi Service”. On an iPhone a location arrow that remains lit in the status bar when Maps is not in use can signal spyware activity.

Account‑level warning signs such as logins from unknown devices or cities disabled two‑factor authentication (2FA, requiring a second verification step) or password reset requests you did not initiate may indicate compromise. The clearest non‑technical clue is when someone knows private details they could only have obtained by monitoring you the “they know too much” tell.

If the iPhone is jailbroken (modified to remove Apple’s software restrictions) or someone has rooted the Android device (given privileged access), spyware can also capture messages from apps such as WhatsApp, Viber, Signal or Skype, record phone conversations, and activate the microphone to listen to surroundings. For iPhone models 6 or newer that are regularly updated the chance of unseen spyware is low; risk increases for older models or unupdated phones if an attacker has physical access and the passcode.

Android’s open architecture makes it more susceptible to spyware installation without the user’s knowledge and easier to conceal traces of such software.

Android devices face a higher risk of remote spyware infection compared to iPhones. The most common way for spyware to get onto a phone is through physical access to the device together with knowledge of the passcode; remote installation is possible but far less likely especially when the user has not clicked suspicious links.

To inspect an iPhone for spyware, look for jailbreak apps (Cydia, Sileo, Zebra), check Settings > General > VPN & Device Management for unknown profiles, review the Apple Account device list (Settings > [your name]), examine mail and calendar accounts for unfamiliar entries, and run Safety Check (Settings > Privacy & Security > Safety Check). Safety Check is an iOS 16 feature that lets users review and reset sharing permissions. After completing iPhone checks change the Apple Account password and confirm that you have enabled two‑factor authentication.

To inspect an Android device for spyware review the full app list (Settings > Apps) audit permissions for microphone camera location or SMS that lack a legitimate need check Device admin apps (Settings > Security) (apps with special privileges that can change device settings) and Accessibility services (Settings > Accessibility) (services that assist users with disabilities but can be misused to monitor activity) and run a scan via Google Play Protect (Play Store > profile > Play Protect > Scan) (Android’s built‑in malware scanner).

On Android revoke device‑admin and accessibility permissions before uninstalling a suspicious app; on iPhone delete any unknown configuration profile first. Before any removal preserve evidence by taking screenshots of suspicious items and back up photos and important files but avoid planning to restore apps from an old backup later as that may reinstall spyware.

Performing a full factory reset and setting the phone up as new without restoring from the old backup removes nearly all spyware; if you suspect deep account access a new phone with a fresh account may be the safest option. As a last resort buying a brand‑new phone eliminates the spyware threat; when setting up a new Android device avoid automatic reinstallation from the old app library and change the Google login password from a safe device.

Run a security scan using Google Play Protect together with a reputable mobile anti‑malware app to detect known spyware families. From a clean unmonitored device change every password starting with email enable two‑factor authentication via an authenticator app (not SMS) and sign out of all active sessions.

Protect your Apple or Google account with a strong unique password and an authenticator‑app based two‑factor authentication. Enable two‑factor authentication for social media email and mobile‑banking accounts to limit credential abuse even if spyware is present.

Update the operating system to the latest version to patch flaws that spyware often exploits. Keep the operating system and all apps updated promptly to receive security patches that close spyware‑exploitable vulnerabilities. On Android disable the setting that allows installation from unknown sources and enable “verify apps” to help block spyware. Turning the phone off or enabling Airplane Mode provides only temporary relief from spyware tracking; note that someone can occasionally fake Airplane Mode so we recommend turning off Wi‑Fi and Bluetooth before activating it.

Be wary of unexpected gifts of phones or tablets which could arrive with stalkerware preloaded and be suspicious if someone insists on updating or fixing your device. If you suspect spyware use a separate safe device such as a library computer or a trusted friend’s phone to seek help or information. In abusive or stalking situations consult a domestic‑violence advocate develop a safety plan and preserve evidence before removing spyware; help is available via the US National Domestic Violence Hotline (1‑800‑799‑7233) and Australia’s 1800RESPECT.

Detecting and removing spyware helps restore privacy safety and control over personal data for individuals facing technology‑facilitated abuse. Advanced or commercial‑grade spyware (e.g., Pegasus‑class) may evade consumer anti‑malware tools; persistent symptoms after a clean scan warrant a professional digital‑forensics examination for court‑admissible evidence.