I recently noticed my phone acting strange. Battery drains way faster than it used to, random apps I never installed keep showing up, and my data usage has gone through the roof. A friend told me it might be spyware. How do I check for spyware on Android and iPhone? What are the signs, and how do I remove it if I find something? Looking for practical advice from people who have dealt with this before.
Alright, so detecting monitoring software on your phone is not as complicated as people make it sound. I went through this exact situation about eight months ago when my Android phone started overheating for no reason and the battery was dying by 2 PM. Let me walk you through what I did step by step.
Step 1: Check your battery usage. Go to Settings, then Battery, and look at the breakdown of which apps are using the most power. If you see something you do not recognize sitting at 15 or 20 percent, that is a red flag. Monitoring software runs in the background constantly and it eats through battery.
Step 2: Look at your data usage. Go to Settings, then Network, then Data Usage. Sort by the apps consuming the most data. Monitoring tools send information to a remote server, so they use mobile data even when you think nothing is happening on the phone. When I checked mine, there was an app with a generic name like “System Service” that had used over 800MB in a month. I had never opened it.
Step 3: Review installed apps. Go to Settings, then Apps, and scroll through every single app on the list. Do not just look at the app drawer because some of these tools hide their icon. You need to go into the full app list in settings. On my phone, I found something called “SyncManager” that was not a real system app even though it tried to look like one.
Step 4: Check for device admin apps. Go to Settings, then Security, then Device Admin Apps (on Android). If something you do not recognize has device administrator access, that is a major red flag. This permission lets an app resist being uninstalled through normal methods.
Step 5: On iPhone, check for unusual profiles. Go to Settings, then General, then VPN and Device Management. If you see a profile you did not install, someone may have sideloaded a monitoring tool through a configuration profile. Also check if your phone is jailbroken by searching for apps like Cydia or Sileo.
Step 6: Run a scan. If it picked up the suspicious app on my phone immediately and flagged it as a PUP (potentially unwanted program).
Step 7: Factory reset if needed. If you find something and you are not sure you got everything, a factory reset is the nuclear option. Back up your photos and contacts first, then wipe the phone completely. Reinstall apps only from the official app store and do not restore from a backup because the monitoring software could be in the backup.
After I did all this, my battery life went back to normal and the weird data usage stopped. The whole process took me about an hour. 
Good breakdown by @SynapseVector121 but I want to add some signs that people usually overlook because they seem so minor.
My girlfriend’s phone had monitoring software on it from an ex and we did not figure it out for almost two months. The signs were super subtle. Her phone would light up randomly in the middle of the night even though no notifications came in. Sometimes during calls, there would be a faint echo or a slight delay that was not there before. And her phone took noticeably longer to shut down, like 15 to 20 seconds instead of the usual 3 to 5.
The thing that finally tipped us off was her data. She has a 5GB plan and she kept running out halfway through the month even though she barely watches videos on mobile. We checked the data breakdown and there was an app called “Phone Health” using over a gig of data. She never installed anything called Phone Health.
On iPhones, another thing to watch for is your iCloud account. If someone has your Apple ID credentials, they can set up iCloud syncing on another device and see your messages, photos, call logs, everything. Go to Settings, tap your name at the top, and look at the list of devices connected to your account. If there is a device you do not recognize, remove it immediately and change your password right after.
Also worth checking your Google account if you are on Android. Go to myaccount.google.com, then Security, then “Your devices.” Same idea. Remove anything that should not be there. These are not technically apps on your phone but they give someone access to a huge amount of your personal data. 
Let me throw a few real world scenarios at you because the signs of monitoring software look different depending on how it got on your phone in the first place.
Scenario 1: Someone had physical access to your phone. This is the most common one. A partner, family member, or roommate grabbed your phone for 10 minutes while you were in the shower. In this case, you are looking for a new app you did not install. It might have a generic name like “System Update” or “Battery Optimizer” or it might be completely hidden. On Android, go to Settings, then Apps, then toggle “Show System Apps” and look for anything suspicious. On iPhone, look for apps like Cydia (means jailbreak) or check for unknown configuration profiles.
Scenario 2: Someone sent you a link and you tapped it. This is the phishing route. You get a text saying “Your package is delayed, click here” or “Someone shared photos of you.” You tap the link and it installs something in the background. For this type, your browser history might have the evidence. Check Chrome or Safari history for URLs you do not remember visiting.
Scenario 3: Someone knows your cloud credentials. No app installed on your phone at all. They just log into your iCloud or Google account from their own device. Your phone will act completely normal because nothing is running on it. The only way to catch this is to check active sessions. On Google, go to Security then “Manage all devices.” On Apple, check Settings then your name then the device list. If you see a laptop or phone you do not own, that is your answer.
Scenario 4: Your phone was set up by someone else. Maybe your employer gave you the phone, or a partner set it up as a gift. In that case, an MDM (Mobile Device Management) profile might be installed. On iPhone, check Settings, General, VPN and Device Management. On Android, check Settings, Security, Device Admin Apps. If there is something there that was set up during initial phone configuration, it has had access since day one.
Each scenario needs a different response. Scenario 1 and 2 mean you need to find and remove the app. Scenario 3 means you change all passwords and enable two factor authentication. Scenario 4 might mean a factory reset is the only clean solution. Figure out which scenario fits your situation first and it will save you a lot of time. 
@DataSculptor Here is a quick checklist to run through. I keep this saved on my computer because I work in IT support and people ask me about this at least once a month.
Signs that monitoring software might be on your Android:
- Battery drops from 100% to 50% in a few hours even when you are barely using the phone
- Phone feels warm or hot when sitting idle on a table
- Data usage spikes with no change in your normal habits
- You hear clicking, static, or echo during phone calls
- The phone takes way too long to turn off or restart
- Apps you never downloaded appear in your app list
- Your phone screen lights up or wakes on its own randomly
- Storage space is disappearing faster than expected
- Phone performance has slowed down noticeably
- You see unfamiliar entries in Device Admin Apps under security settings
Signs that monitoring software might be on your iPhone:
- Battery health is fine but battery still drains abnormally fast
- You find a configuration profile under General settings that you did not install
- Apps like Cydia or Sileo are present (indicates jailbreak)
- Your iCloud shows devices you do not own
- Data usage is higher than normal with no clear reason
- Phone gets warm during standby
- Screen lights up at random with no visible notification
- Siri starts acting unusual or activating on its own
Removal steps for both platforms:
- Delete any app or profile you did not install
- Revoke device admin permissions for unknown apps before trying to uninstall
- Change your Apple ID or Google account password immediately
- Turn on two factor authentication for every account
- If nothing works, factory reset the phone and set it up as new (do NOT restore from backup)
- After the reset, install apps one by one from the official store only
- Monitor your battery and data for the next week to make sure the problem is gone
This covers about 95% of cases. If you are dealing with something more advanced like Pegasus level stuff, that is a different conversation entirely and you would need professional forensic analysis. But for the average person, this checklist handles it. 
This whole topic makes me think about something bigger. We live in a time where the line between legitimate monitoring and straight up privacy violation is getting blurry. I mean, parents install monitoring apps on their kids phones and call it safety. Employers put MDM profiles on work phones and call it policy compliance. Partners share location with each other and call it trust.
But then at what point does any of that cross the line? If your employer’s MDM can read your personal texts on a work phone, is that acceptable just because you signed an agreement? If a parent reads every message their 17 year old sends, is that still parenting?
I am not saying monitoring is wrong across the board. There are absolutely situations where it is necessary and even required by law (like corporate compliance). But I think the conversation about detection is incomplete without talking about the ethics of it too.
@DataSculptor for your specific situation, the practical advice in this thread is solid. Run the checks, clean your phone, change your passwords. But also think about who in your life had access to your phone recently. That usually narrows things down fast. The technology is just the tool. The real question is who used it and why.
Curious what other people here think about where the line should be drawn. Is there a difference between a parent monitoring a 12 year old versus a 17 year old? Between an employer monitoring a company phone versus a personal phone used for work? 
Since a lot of the same questions keep coming up in these threads, let me just knock out the most common ones in a FAQ style because I see people asking the same stuff in every forum.
Q: Can someone install monitoring software remotely without touching my phone?
A: On iPhone, not really. iOS is locked down tight and requires either physical access or your iCloud credentials. On Android, it is technically possible through phishing links or if someone has your Google account login, but most monitoring tools still need someone to physically handle the phone for at least a few minutes during setup.
Q: Will a factory reset remove everything?
A: In 99% of cases, yes. A factory reset wipes the phone clean. The only exception is if someone has installed something at the firmware level, which is extremely rare and basically only happens with state-level tools like Pegasus. For the average person, a factory reset followed by setting up the phone as new (not from a backup) will solve the problem.
Q: My phone is slow and the battery drains fast. Does that mean I have monitoring software?
A: Not necessarily. Old batteries, too many apps running, outdated software, and even a bad cell signal can cause the same symptoms. Do not jump to conclusions. Run through the detection steps first and see if you actually find anything suspicious before assuming the worst.
Q: Can antivirus apps detect monitoring software?
A: Some can. Malwarebytes and Lookout are the best at catching known monitoring tools. But they are not perfect. If the software is well hidden or uses a custom build, automated scans might miss it. Manual checking (app list, device admins, profiles) is still the most reliable method.
Q: Does monitoring software work on encrypted messaging apps like Signal or WhatsApp?
A: If the software has accessibility permissions on Android, it can capture what is on the screen regardless of whether the app is encrypted. Encryption protects data in transit (between your phone and the server) but if something is recording your screen or logging keystrokes directly on the device, encryption does not help. That is why checking accessibility permissions in your settings is so important.
Q: How do I prevent this from happening again?
A: Use a strong lock screen PIN or password (not a pattern, those are too easy to observe). Enable two factor authentication on your Google and Apple accounts. Do not leave your phone unattended and unlocked. Do not click links from unknown numbers. And review your installed apps and permissions at least once a month. Prevention is way easier than detection. 
Good thread with solid info. I want to organize the detection process into a numbered priority list because when you are panicking about possible monitoring software on your phone, you need a clear order of operations. Not everything needs to be done at once.
-
Check your accounts first. Go to Google (myaccount.google.com > Security > Your Devices) or Apple (Settings > Your Name > device list) and remove anything you do not recognize. This takes 2 minutes and catches the easiest form of unauthorized access.
-
Look at battery and data stats. Settings > Battery and Settings > Data Usage. Write down anything using abnormal amounts of either. Do not delete anything yet, just note it down.
-
Review all installed apps including system apps. On Android, toggle “Show System Apps” in the app list. On iPhone, scroll through every home screen and check the App Library. Look for names that sound generic or technical, things like “System Service”, “Connectivity Manager”, or “Phone Optimizer”.
-
Check Device Admin Apps (Android) or Device Management Profiles (iPhone). Anything listed here that you did not set up yourself is a problem. On Android: Settings > Security > Device Admin Apps. On iPhone: Settings > General > VPN and Device Management.
-
Check accessibility services on Android. Settings > Accessibility. This is the most powerful permission on Android. If a monitoring tool has this permission, it can read everything on your screen, log keystrokes, and capture messages from any app. I have seen tools like Xnspy and mSpy listed here on phones I have checked for friends. If you see any app in accessibility services that you did not specifically enable, turn it off immediately.
-
Scan with Malwarebytes. Install it from the Play Store or App Store, run a full scan, and see what it finds. It is free for manual scans.
-
Check for root (Android) or jailbreak (iPhone). On Android, download Root Checker from the Play Store. On iPhone, search for Cydia or Sileo apps. If the phone is rooted or jailbroken and you did not do it, someone else did it to install software that needs deeper access.
-
Review your browser history. Look for URLs you did not visit, especially any that end in .apk (Android app files) or that look like short links. Someone may have used your browser to download an installer.
-
Check Google Play Protect (Android). Go to Play Store > tap your profile > Play Protect > Scan. Google scans your apps against known threats. It is not perfect but it catches a lot.
-
If you found anything suspicious in steps 1 through 9, factory reset the phone and set it up as new. Do not restore from a backup. Change every password you have. Enable two factor authentication everywhere.
Follow this order and you will catch 99% of monitoring tools. If you go through all 10 steps and find nothing, your phone is almost certainly clean and the battery or performance issues are probably caused by something else. 
Going to play a bit of a contrarian here because I think some of the advice in this thread, while good, can also lead to unnecessary panic.
A lot of people assume that a hot phone plus bad battery equals monitoring software. But that is not always the case. My coworker was convinced her phone was compromised because her battery was draining fast and the phone was warm all the time. She spent two days going through every detection method, ran multiple scans, checked every permission. Found nothing. Turns out her phone case was trapping heat and she had 47 Chrome tabs open running in the background. Closed the tabs, switched the case, problem solved.
Another friend was sure he had something on his phone because his data usage spiked. He was about to factory reset when I asked him if anything changed recently. Turns out he had turned on high quality photo backup to Google Photos the week before and it was uploading years of photos in the background.
My point is not that you should ignore the signs. Absolutely check if something feels off. But do not start from the assumption that someone is watching you. Start from the simplest explanation and work your way up. Check your open tabs, check your background app refresh settings, check if any app recently updated and started behaving differently.
If you go through the simple stuff and things still do not add up, then escalate to the detailed checks others have described. But jumping straight to “someone is monitoring me” when your battery dies fast can send you down a stressful path that might not even be the right one.
That said, @DataSculptor mentioned apps appearing that they never installed, and that one is harder to explain away. Random battery drain could be anything. Unknown apps showing up is a real red flag. So in your specific case, yeah, dig deeper. But for anyone else reading this who just has a hot phone, check the basics first. 
Since people are recommending different detection and scanning tools in this thread, let me do a comparison of the main options so you can pick the right one for your situation.
Malwarebytes vs Lookout vs Avast vs Bitdefender for detecting monitoring software on mobile:
Malwarebytes is probably the best free option for a one time scan. It has a solid database of known monitoring tools and PUPs. The free version lets you scan manually and it catches most of the commercial tools like FlexiSpy, mSpy, and similar products. Downside is the free version does not offer real time protection, so it only finds stuff when you run a scan.
Lookout is decent for ongoing protection. It runs in the background and alerts you if something suspicious gets installed. But I have found it misses some of the stealthier monitoring apps that disguise themselves as system processes. It is better at catching malware than it is at catching dedicated monitoring software.
Avast and Bitdefender are the generalist antivirus apps. They are good at catching traditional malware like trojans and adware, but monitoring software specifically designed for phones often flies under their radar. These tools are built for a different threat profile.
Now here is the gap that none of these scanners address. They can tell you if something known is on your phone right now. But they cannot tell you if someone accessed your cloud accounts, if someone set up call forwarding on your number, or if someone cloned your SIM card. For cloud account monitoring, you need to manually check your active sessions like others mentioned. For call forwarding, dial ##002# on your phone to reset all forwarding settings. For SIM cloning, contact your carrier and ask if there are any duplicate SIMs active on your number.
Another thing worth comparing is how different monitoring tools show up on the phone. Some apps like Xnspy or mSpy can be configured to hide their app icon, which means you will not see them in your regular app drawer. You have to go through the full app list in settings to find them. Others like Google Family Link and Bark are designed to be visible because they are marketed for parental use. So the type of monitoring tool also determines how you need to search for it.
If you want to be thorough, use Malwarebytes for the automated scan and then do a manual check of your app list, device admin apps, accessibility services, and cloud account sessions. No single tool catches everything, so layering your approach is the way to go. 
@TitanMatrix brought up a good point about the ethics, but I want to refocus on the actual process of securing your phone after you find and remove something. Because removal is only half the battle. If you do not lock things down after, whatever was there can come right back.
The process after removal should go like this.
Phase 1: Immediate lockdown. Change your phone lock screen to a strong PIN, at least 6 digits. Change your Google or Apple ID password from a different device (not the compromised phone). Enable two factor authentication on both. Log out all active sessions on every account you can think of, email, social media, banking, everything.
Phase 2: Secure your phone number. Call your carrier and ask them to add a PIN or password to your account. This prevents SIM swap attacks where someone transfers your number to a new SIM. Also ask if there are any call forwarding rules active on your line. If you did not set them, have the carrier remove them.
Phase 3: Audit app permissions. Go through every app on your phone and review what permissions it has. No weather app needs microphone access. No calculator needs access to your contacts. Strip permissions down to the minimum each app needs to function. On Android: Settings > Apps > select app > Permissions. On iPhone: Settings > Privacy and Security.
Phase 4: Ongoing monitoring. For the next month, check your battery stats and data usage weekly. Compare them to what you saw before the issue. If the numbers go back to abnormal after being normal for a while, something might have been reinstalled.
Phase 5: Physical security. This sounds basic but it matters. Do not leave your phone unlocked around people you do not fully trust. Enable auto lock after 30 seconds. Turn off USB debugging on Android (Settings > Developer Options). On iPhone, turn off the “Accessories” option when locked.
A lot of people do the removal part and then go right back to the same habits that let it happen in the first place. Treat it like changing the locks after a break in. You do not just fix the door and call it a day. You upgrade the whole system. 
How Monitoring Software Actually Works on Android and iPhone at a Technical Level
I think understanding how these tools work under the hood makes it way easier to detect and prevent them. Most guides just tell you what to look for without explaining why you are looking for it. So let me break down the technical side in a way that makes sense.
How Monitoring Software Functions on Android
Android is an open ecosystem compared to iOS, which is exactly why it is more vulnerable to monitoring tools. When someone installs a monitoring app on an Android phone, the app typically requests a few key permissions during setup.
Accessibility Service is the big one. This is a legitimate Android feature designed for users with disabilities. Screen readers and voice assistants use it. But monitoring software abuses it because accessibility services can read everything displayed on the screen. That means every message you type in WhatsApp, every email you open in Gmail, every search you make in Chrome. The app does not need to break encryption because it reads the content after your phone has already decrypted it for display. Think of it like someone reading over your shoulder instead of intercepting your mail.
Device Administrator permission is the second one to watch. This permission was designed for corporate IT departments to manage company phones remotely. But monitoring tools use it to prevent you from uninstalling the app through normal means. If you try to delete an app that has device admin access, Android will tell you to revoke the permission first. Some people do not know how to do that and just give up, which is exactly what the software is counting on.
Background Services and Data Transmission
Once running, the monitoring app creates a background service that stays active even when the phone screen is off. This service collects data like call logs, text messages, location coordinates, and screenshots. It stores this data temporarily on the phone and then uploads it to a remote server in batches. This is why you see spikes in data usage that do not match your normal behavior. The uploads usually happen over WiFi when available to avoid detection through unusual mobile data usage, but if WiFi is not available, it falls back to mobile data.
The background service also explains the battery drain. Keeping a service running 24/7 that is logging screen activity, recording GPS coordinates every few minutes, and periodically uploading data takes a lot of processing power. Your phone is basically doing double the work it normally does.
How It Works on iPhone
iOS is much more locked down. Apple does not allow apps to run persistent background services the way Android does, and the App Store review process catches most monitoring tools before they ever get published. So there are really only two ways monitoring software ends up on an iPhone.
The first is jailbreaking. This removes Apple’s restrictions and allows installation of apps from outside the App Store. Jailbreaking used to be common back in the iOS 9 and 10 days but it is much less common now. If your iPhone is on iOS 16 or later and has not been jailbroken, the range of monitoring tools that can be installed is very limited.
The second way is through iCloud credential theft. If someone has your Apple ID email and password, they can sign into iCloud on their own device and access your messages (if iCloud message sync is on), photos, notes, location through Find My, and even your Safari browsing history. No app is installed on your phone. Nothing will show up in a scan. The only way to detect this is to check your Apple ID device list and active sessions.
Why This Matters for Detection
When you understand the technical process, the detection steps make more sense. Checking accessibility services is not just a random suggestion. It is because that specific permission is what gives monitoring tools their power on Android. Checking battery and data usage is not about the numbers themselves. It is about finding the footprint of background services that should not be there. And on iPhone, checking your device list is the single most important step because iCloud based monitoring leaves zero trace on the phone itself.
Know what the software needs to function and you know exactly where to look for it. 
I am going to share my personal take on this whole situation because I have been on both sides of it, and that gives me a perspective that might be useful.
A few years ago, I installed a monitoring app on my teenage son’s phone after he got into some trouble online. I used Xnspy because it gave me access to messages, call logs, location history, and social media activity all in one place. As a parent, I felt like I needed that level of visibility to keep him safe and I stand by that decision.
But then last year, I started noticing the same symptoms on my own phone. Battery draining fast, phone getting warm for no reason, data usage going up. I went through all the detection steps and found that my ex had installed something on my phone during a visit. Same type of tool, different context, completely different feeling.
When it was on my son’s phone, it felt like protection. When it was on mine, it felt like a violation. Same technology, different intent. That experience changed how I think about the whole topic.
For @DataSculptor, the practical side is clear. Follow the steps people have laid out here and clean your phone. But also take a minute to think about who had access to your phone and what their motivation might be. If it is an ex partner, that is a safety issue and you might want to document what you find before deleting it. Take screenshots of the apps, the permissions, and the data usage before you remove anything. That evidence could be important later.
If it is an employer on a work phone, check your employment agreement because they may actually have the right to do it depending on what you signed.
Context matters just as much as detection. 
The Complete Android vs iPhone Security Comparison for Monitoring Software Protection
Since this thread has covered detection and removal really well, I want to zoom out and talk about the security differences between Android and iPhone when it comes to vulnerability to monitoring tools. Knowing this helps you make better decisions about which phone to use and how to configure it.
Android: More Open, More Vulnerable
Android allows app installation from outside the Google Play Store. This feature, called sideloading, is the primary way monitoring tools get on Android phones. All someone needs to do is go to Settings, enable “Install Unknown Apps” for the browser, download an APK file from a website, and install it. The whole process takes about 5 minutes with physical access to the phone.
On top of that, Android’s permission system gives apps very broad access if the user (or whoever set up the app) grants it. Accessibility services, device admin, usage access, notification access. These are all powerful permissions that monitoring tools combine to get a complete picture of phone activity.
The good news is that Android also gives you more tools to detect monitoring software. You can see every installed app including system apps. You can check exactly which apps have which permissions. Google Play Protect scans for known threats automatically. And the battery and data usage breakdowns are detailed enough to spot suspicious background activity.
How to Lock Down Android
Disable “Install Unknown Apps” for every app in Settings. Turn off USB Debugging in Developer Options (or disable Developer Options entirely). Set a strong screen lock and enable auto lock after 30 seconds. Regularly review apps with accessibility and device admin permissions. Keep Google Play Protect enabled and run manual scans occasionally.
iPhone: More Locked Down, Fewer Attack Vectors
iOS does not allow sideloading under normal circumstances. Every app has to go through Apple’s review process before appearing on the App Store, and Apple actively rejects apps with hidden monitoring capabilities. This single fact eliminates the vast majority of monitoring tools.
The main vulnerabilities on iPhone are jailbreaking and iCloud credential theft. Jailbreaking requires physical access and technical knowledge, and modern iOS versions are increasingly difficult to jailbreak. iCloud theft is the more realistic threat and it requires no technical skill at all, just your email and password.
One limitation of iPhone is that if a monitoring tool is installed through a jailbreak, detection is harder because iOS does not give you the same level of visibility into system processes that Android does. There is no “show system apps” toggle. No detailed per-app battery breakdown (Apple simplified this in recent iOS versions). So on iPhone, prevention is more effective than detection.
How to Lock Down iPhone
Use a strong alphanumeric passcode instead of a 4 or 6 digit PIN. Enable two factor authentication for your Apple ID. Check Settings > General > VPN and Device Management regularly. Review the device list under your Apple ID settings. Turn on Lockdown Mode if you are in a high risk situation (Settings > Privacy and Security > Lockdown Mode). This is a built in iOS feature that restricts a lot of attack vectors at the cost of some functionality.
Which Platform Is Safer?
For the average person, iPhone is harder to compromise with monitoring software because of the sideloading restriction alone. But it is not bulletproof, especially if your iCloud credentials are weak. Android is more vulnerable to app based monitoring tools but gives you better tools to detect them after the fact. Neither platform is perfectly safe. Your behavior and security hygiene matter more than the phone you carry. 