📱 Is My Phone Being Tracked? A Vendor-Free Checklist (2026)

At a glance: how phones are really tracked, and what to check

Could someone you live with be monitoring your phone? Read this first

This checklist tells you how to find things. Whether and when to remove them is a safety decision. Sometimes leaving a tracker or a sharing setting in place for a while is part of a safety plan NNEDV Safety Net: location tracking (checked 10 Oct 2026). On iPhone, every Safety Check screen has a Quick Exit button that closes Settings at once and keeps the changes you have already made Apple Personal Safety Guide: Safety Check (checked 10 Oct 2026).

How can you tell if your phone is being tracked or hacked?

Look for specific events, not general sluggishness. The strongest signals come from the platforms themselves: a security alert, a sign-in you didn't make, or a tracker alert. Survivor organisations also say the most common sign of monitoring is the other person's behaviour, because they know things they could only know from your phone Coalition Against Stalkerware: information for survivors (checked 10 Oct 2026) NNEDV Safety Net: phone stalkerware (checked 10 Oct 2026).

A "virus" in the desktop sense is uncommon on phones that only install from the App Store or Google Play (our assessment). The practical question is the one this guide answers: is a person, an account or an app getting your data? On Android, Google Play Protect already scans apps from Google Play before you install them and checks apps from other sources Google Play Help: Play Protect (checked 10 Oct 2026).

Is someone tracking you through your Apple Account or Google account?

This is the most common route, and you can check it in minutes. If someone knows your Apple Account password, Apple says "they can view information that is synced across devices", such as Messages and location, and your account also holds "payment info, photos, device backups" Apple Personal Safety Guide: Apple Account security (checked 10 Oct 2026). The same applies to a Google account: anyone signed in can use Find Hub to see an Android phone's estimated location and ring, lock or erase it Android Help: Find Hub (checked 10 Oct 2026).

1. Which devices are signed in?

• iPhone: Settings > [your name], then scroll to the device list, or sign in at account.apple.com Apple Personal Safety Guide: Apple Account security (checked 10 Oct 2026). Remove any device you don't recognise Apple Support: compromised Apple Account (published 5 Dec 2025).
• Google: myaccount.google.com > Security & sign-in > Your devices > Manage all devices, or google.com/devices. If several sessions share one device name, sign out of all of them Google Account Help: devices with account access (checked 10 Oct 2026). Google's Security Checkup walks through devices, protections and recent security activity Google Security Checkup (checked 10 Oct 2026).

2. Who can see your location?

• Find My (iPhone): open Find My and tap People. With Family Sharing and location sharing on, family members appear there automatically Apple Personal Safety Guide: Find My and location sharing (checked 10 Oct 2026). Safety Check shows people and apps with access in one place Apple Personal Safety Guide: Safety Check (checked 10 Oct 2026).
• Google Maps: myaccount.google.com > People & sharing > Location Sharing > Manage Location Sharing. Google notes the setting is "device and account-specific", so check each phone and account Google Maps Help: location sharing (checked 10 Oct 2026).
• Find Hub (Android): when someone locates your phone through Find Hub, "the lost device gets a notification" Android Help: Find Hub (checked 10 Oct 2026). An unexplained notification like that is worth noting.

3. Are your messages, calls or mail being forwarded?

• Calls: Settings > Apps > Phone > Call Forwarding on iPhone. Turning it off "doesn't notify the phone number that was receiving forwarded calls" Apple Personal Safety Guide: forwarding settings (checked 10 Oct 2026).
• Texts: Settings > Apps > Messages > Text Message Forwarding shows which devices can send and receive your texts Apple Personal Safety Guide: forwarding settings (checked 10 Oct 2026). Apple also suggests asking your carrier whether SMS forwarding has been turned on for your number Apple Support: compromised Apple Account (published 5 Dec 2025).
• Email: in iCloud Mail on the web, check Settings > Forwarding and also your Rules Apple Personal Safety Guide: forwarding settings (checked 10 Oct 2026). In Gmail, check Settings > See all settings > Forwarding and POP/IMAP, and your filters: a filter can forward selected messages even when automatic forwarding is off. Gmail shows a reminder only for the first week after forwarding is turned on Gmail Help: automatic forwarding (checked 10 Oct 2026). Google's compromised-account checklist says to remove forwarding rules and filters you didn't set up, and to review apps with access to your account Google Account Help: secure a compromised account (checked 10 Oct 2026).

4. Backups and mirroring

• iCloud Backup: the Coalition Against Stalkerware says "some iPhone and iPad stalkerware works by acquiring data from backups of your device stored in iCloud". If iCloud Backup is on and you didn't turn it on, someone else may have Coalition Against Stalkerware: information for survivors (checked 10 Oct 2026). The fix is to secure the Apple Account (new password, remove unknown devices), not just to switch off backup.
• iPhone Mirroring: a Mac can mirror and control your iPhone only when both are signed in to the same Apple Account. See and remove allowed Macs in Settings > General > AirPlay & Continuity > iPhone Mirroring, or in Safety Check Apple Personal Safety Guide: iPhone Mirroring (checked 10 Oct 2026).

Change passwords from a device the other person hasn't touched, turn on two-factor authentication, and make sure you control every trusted phone number and recovery address Apple Support: compromised Apple Account (published 5 Dec 2025) Google Account Help: secure a compromised account (checked 10 Oct 2026). Our password security guide covers how passwords get stolen and reused.

iPhone vs Android: which settings should you check?

The same checks exist on both platforms under different names. Menu paths are as given in Apple and Google help pages on 10 October 2026; Android paths can vary by manufacturer.

How do you find an AirTag or Bluetooth tracker that is following you?

Let the phone do the first pass, then search physically. Since 13 May 2024, Apple and Google have supported a shared specification, Detecting Unwanted Location Trackers, so that iPhones (iOS 17.5) and Android phones (6.0 or later) alert you to an unknown Bluetooth tracker moving with you, whichever platform it is paired with. Chipolo, eufy, Jio, Motorola and Pebblebee committed to making future tags compatible Apple Newsroom, Apple and Google (13 May 2024). The original Apple–Google Internet-Draft is now expired IETF datatracker: Detecting Unwanted Location Trackers draft (rev. 20 Dec 2023); the work continues in the IETF's active DULT working group IETF DULT working group (checked 10 Oct 2026).

On iPhone

• Update to iOS 17.5 or later. Keep Location Services and Bluetooth on, allow Tracking Notifications, and stay out of Airplane Mode, which stops tracking notifications Apple Support: AirTag alerts (published 24 Sep 2026).
• When an alert appears, tap it, tap Continue, then Play Sound. Hold the top of your iPhone near the white side of an AirTag to open a page with its serial number, then tap Instructions to Disable Apple Support: AirTag alerts (published 24 Sep 2026). Past alerts are under Find My > Items > Items Detected With You Apple Personal Safety Guide: detect unwanted trackers (checked 10 Oct 2026).
• Turning off Find My, Bluetooth or Location Services on your phone does not stop the owner seeing the item's location Apple Support: AirTag alerts (published 24 Sep 2026).

On Android

• Go to Settings > Safety & emergency > Unknown tracker alerts (on Android 11 and lower: Google > Personal & device safety). Alerts cover Find Hub-compatible tags, headphones and Apple AirTags Android Help: find unknown trackers (checked 10 Oct 2026).
• Tap Scan now for a manual scan, which takes about 10 seconds. Playing a sound does not notify the owner. Alerts are deleted after 48 hours, and you get at most one alert per tracker per day, so screenshot an alert if you may need it later Android Help: find unknown trackers (checked 10 Oct 2026).
• Putting your phone in airplane mode or turning off Bluetooth or location does not stop a tracker sharing its location. To turn a tracker off, follow its manufacturer's instructions; the owner may still see its last known location Android Help: find unknown trackers (checked 10 Oct 2026).

Limits, and the physical search

• Alerts are deliberately slow, to avoid false alarms: you "need to physically move with the tracker over time" before an alert Android Help: find unknown trackers (checked 10 Oct 2026). EFF found alerts can take up to 24 hours and that newer tracker models "aren't always detected" EFF Surveillance Self-Defense: detect Bluetooth trackers (reviewed 15 Jul 2024).
• An AirTag separated from its owner for a while plays a sound when moved Apple Personal Safety Guide: detect unwanted trackers (checked 10 Oct 2026). EFF suggests searching anywhere a tracker "about the size of a U.S. Quarter (or 1 Euro)" could hide: pockets, bag linings, under a car EFF Surveillance Self-Defense: detect Bluetooth trackers (reviewed 15 Jul 2024).
• Bluetooth tag vs GPS tracker: phone alerts are built for Bluetooth tags on the Apple and Google networks. Safety Net notes that dedicated GPS devices are also hidden in cars and belongings and usually need a power source, and that cars' own navigation systems can reveal where you have been NNEDV Safety Net: location tracking (checked 10 Oct 2026). A GPS unit with its own connection won't trigger a phone alert (our inference from the scope of the alerts above), so search the car physically or ask an advocate or police for help.
• If you feel unsafe, go to a public place and contact law enforcement; for Apple items, police can request owner information from Apple Apple Personal Safety Guide: detect unwanted trackers (checked 10 Oct 2026) Android Help: find unknown trackers (checked 10 Oct 2026). EFF points out that an abusive partner may own the tracker, and recommends a safety plan before disabling it EFF Surveillance Self-Defense: detect Bluetooth trackers (reviewed 15 Jul 2024).

For tags built into other ecosystems, see our Ring & Sidewalk OpSec guide.

How do you check for stalkerware, spyware apps, profiles and device admin apps?

Stalkerware is software, an app or a device "that enable[s] someone to secretly spy" on another person; it runs hidden, "without the affected person knowing or giving their consent" Coalition Against Stalkerware (checked 10 Oct 2026). Spyware is the broader term; in this guide, stalkerware means spyware used by someone you know (our working definition). Almost all phone stalkerware needs physical access to the phone to install NNEDV Safety Net: phone stalkerware (checked 10 Oct 2026), so a phone someone else has held, set up or "fixed" for you deserves the closest look.

iPhone

• Configuration profiles and MDM. Go to Settings > General > VPN & Device Management. If nothing is listed, no profiles are installed. A profile can manage account and device settings, and management tools "may allow access to data or location information on the device". Deleting a profile removes its settings, apps and data. On a school or work phone, ask the administrator first Apple Personal Safety Guide: configuration profiles (checked 10 Oct 2026).
• App permissions. Safety Check's Manage Sharing & Access lets you see and turn off third-party apps' access to Location Services, Camera, Microphone, Contacts, Photos, Bluetooth and more Apple Personal Safety Guide: Safety Check FAQ (checked 10 Oct 2026). It does not scan for spyware (it reviews sharing and access only) Apple Personal Safety Guide: Safety Check FAQ (checked 10 Oct 2026).
• iCloud. Because some iPhone stalkerware reads iCloud backups, account security matters as much as the phone itself Coalition Against Stalkerware: information for survivors (checked 10 Oct 2026). See section 3.
• Lockdown Mode blocks installing configuration profiles and enrolling in device management while it is on Apple Support: Lockdown Mode (published 14 Sep 2026).

Android

• Apps from outside the Play Store. The Coalition advises looking for apps that are "hidden and/or installed outside the official app store" Coalition Against Stalkerware: information for survivors (checked 10 Oct 2026). Check the full app list in Settings, including system apps you don't recognise.
• Play Protect. It checks apps from other sources, "periodically scans your device", warns about potentially harmful apps and "may deactivate or remove" them. Make sure Scan apps with Play Protect is on (Play Store > profile > Play Protect > Settings) Google Play Help: Play Protect (checked 10 Oct 2026).
• Device admin apps. Device administration lets an app enforce password rules, lock the phone immediately or wipe it to factory settings, and "to uninstall an existing device admin app, users need to first unregister the app as an administrator" Android Developers: device administration (checked 10 Oct 2026). An admin app you didn't install is a red flag. The menu name and location vary by manufacturer, so search Settings for "device admin".
• Advanced Protection keeps Play Protect on and blocks installing apps from unknown sources Android Help: Advanced Protection (checked 10 Oct 2026).

Do you need a "spyware scanner" app?

This guide recommends no products. The Coalition Against Stalkerware notes that an antivirus scan can detect and remove stalkerware Coalition Against Stalkerware: information for survivors (checked 10 Oct 2026); many of its members are security companies Coalition Against Stalkerware (checked 10 Oct 2026), so weigh that advice accordingly. Remember the safety section: a scanner that removes an app automatically also removes evidence and may tip off the person who installed it Coalition Against Stalkerware: information for survivors (checked 10 Oct 2026).

Has your phone been cloned or SIM-swapped?

"Cloned" usually means something different today. The FCC defines a cloned phone as one "reprogrammed to transmit the ESN and MIN belonging to another cell phone", so both phones look identical to the network and the real owner is billed for the clone's calls FCC consumer guide: cell phone fraud (checked 10 Oct 2026). The modern problem is SIM swapping and port-out fraud: a scammer persuades your carrier that they are you, or steals your SIM, and your number is "ported to a different mobile device controlled by the scammer". Because banks and other services send verification codes by text, the scammer can then reach your accounts FCC consumer guide: cell phone fraud (checked 10 Oct 2026).

• Warning signs. Your phone suddenly has no service while others nearby do, you get carrier messages about a SIM change or port you didn't request, or you see calls or charges you didn't make. The FCC says to alert your provider about unauthorised calls or charges FCC consumer guide: cell phone fraud (checked 10 Oct 2026); the first two signs are our inference from how a swap works. Call the carrier from another phone.
• Ask for the lock. FCC rules adopted on 15 November 2023 (FCC 23-95) require carriers to use secure authentication before a SIM change or port, to notify you immediately when one is requested, before it completes, and to offer a free account lock that blocks SIM changes and ports FCC 23-95, Federal Register 88 FR 85794 (8 Dec 2023). The rule text delayed some provisions until a later notice, so ask your carrier what it currently offers FCC 23-95, Federal Register 88 FR 85794 (8 Dec 2023). If your carrier offers a port-out PIN or account passcode, set one (our advice).
• eSIM helps, but not fully. According to the FCC, eSIMs remove some of the risk of a physical SIM being stolen, but "port-out scams remain a security concern". Wipe the eSIM when you replace a phone FCC consumer guide: cell phone fraud (checked 10 Oct 2026).
• Reduce what a swap gives away. Where a service allows it, use an authenticator app or passkey instead of SMS codes (see our password security guide).

Is my phone tapped? What call interception realistically means

For most people, "tapped" is the wrong question. Ordinary calls and texts can be intercepted in places your phone can't see, so no app or dial code can prove your line is or isn't tapped (our assessment). What is documented:

• The network always knows roughly where you are. While a phone is on and connected, "the cellular provider can calculate where a particular subscriber's phone is located". Governments can compel carriers to hand over that data, and in the US police need a warrant for historical cell-site location data under Carpenter v. United States EFF Surveillance Self-Defense: location tracking (reviewed 5 Nov 2024).
• Fake cell towers exist. IMSI catchers (cell-site simulators) pretend to be towers to detect and spy on nearby phones. Many rely on 2G, so EFF suggests disabling 2G on Android; on iPhone, Lockdown Mode does so EFF Surveillance Self-Defense: location tracking (reviewed 5 Nov 2024). Apple says Lockdown Mode turns off 2G and 3G support Apple Support: Lockdown Mode (published 14 Sep 2026), and Android's Advanced Protection blocks 2G connections on supported devices Android Help: Advanced Protection (checked 10 Oct 2026).
• Encryption protects content. EFF recommends end-to-end encrypted messaging so that message content can't be intercepted, though this doesn't hide your location or who you talk to EFF Surveillance Self-Defense: location tracking (reviewed 5 Nov 2024).
• The mundane "tap" is forwarding. Call forwarding, text forwarding to another signed-in device, or iPhone Mirroring to a Mac can all copy your communications, and you can check each one yourself (Apple Personal Safety Guide: forwarding settings (checked 10 Oct 2026), Apple Personal Safety Guide: iPhone Mirroring (checked 10 Oct 2026)). See section 3.

Clicks, echoes and static on a call are not evidence of interception (our assessment). To see what your own phone or network exposes, try our Connection Fingerprint check, and for cell-tower and Wi-Fi lookups see Wireless OSINT.

Could it be Pegasus or other mercenary spyware, and how would you know?

Mercenary spyware such as NSO Group's Pegasus is aimed at specific people, not at the public at large. Apple says these attacks target people "because of who they are or what they do", such as journalists, activists, politicians and diplomats, and that "the vast majority of users will never be targeted" Apple Support: threat notifications (published 13 Aug 2026). Amnesty International's Security Lab published its forensic methodology on 18 July 2021, after analysing devices of human rights defenders and journalists worldwide Amnesty International: Forensic Methodology Report (18 Jul 2021). In September 2023 Citizen Lab caught a Pegasus exploit chain it called BLASTPASS that could compromise an iPhone running the latest iOS (16.6) "without any interaction from the victim"; Apple fixed it as CVE-2023-41064 and CVE-2023-41061 Citizen Lab: BLASTPASS (7 Sep 2023).

Apple threat notifications

• Apple has sent them "multiple times a year" since 2021, to users "in over 150 countries in total". They appear on the iPhone Lock Screen and in Settings, by email from [email protected], and as a banner at account.apple.com Apple Support: threat notifications (published 13 Aug 2026).
• They "never ask the user to click any links, open files, install apps or profiles", or ask for a password or code. An email claiming to be a Pegasus warning that does ask you to click is a scam Apple Support: threat notifications (published 13 Aug 2026).
• Apple calls them "high-confidence alerts" but says its investigations "can never achieve absolute certainty", and it does not attribute attacks to particular attackers or regions Apple Support: threat notifications (published 13 Aug 2026).
• If you get one, Apple recommends Lockdown Mode and expert help, pointing to Access Now's 24/7 Digital Security Helpline Apple Support: threat notifications (published 13 Aug 2026).

Can you check for Pegasus yourself?

Not reliably. Amnesty's Mobile Verification Toolkit (MVT) supports "consensual forensic analysis of Android and iOS devices" MVT documentation (checked 10 Oct 2026), but its documentation says it is "intended for technologists and investigators", that it "is not intended for end-user self-assessment", and that public indicators of compromise "are insufficient to determine that a device is 'clean'". Its advice to worried users: "please seek expert assistance" MVT documentation: introduction (checked 10 Oct 2026). Any app that promises a quick Pegasus "test" deserves scepticism (our assessment).

What reduces the risk

• Update promptly. Citizen Lab's advice after BLASTPASS: "We urge everyone to immediately update their devices" Citizen Lab: BLASTPASS (7 Sep 2023).
• Lockdown Mode (iOS 16 or later) restricts attachments and links in Messages, complex web technologies, unknown FaceTime callers and more Apple Support: Lockdown Mode (published 14 Sep 2026). Citizen Lab said "Lockdown Mode blocks this particular attack" Citizen Lab: BLASTPASS (7 Sep 2023).
• Advanced Protection on Android adds an optional Intrusion Logging feature that stores encrypted security logs to help investigate a suspected compromise Android Help: Advanced Protection (checked 10 Oct 2026).

What should you do next? A step-by-step checklist

1. Decide whether it is safe to change things. If the person may be someone close to you, talk to an advocate first, from a safer device (section 1) Coalition Against Stalkerware: information for survivors (checked 10 Oct 2026) NNEDV Safety Net: phone stalkerware (checked 10 Oct 2026).
2. Write things down. Dates, alerts, screenshots, and what the person knew NNEDV Safety Net: location tracking (checked 10 Oct 2026). Android tracker alerts disappear after 48 hours Android Help: find unknown trackers (checked 10 Oct 2026).
3. Update the phone to the latest iOS or Android version Citizen Lab: BLASTPASS (7 Sep 2023).
4. Secure the accounts from a clean device: new passwords, two-factor authentication, remove unknown devices, fix recovery details Apple Support: compromised Apple Account (published 5 Dec 2025) Google Account Help: secure a compromised account (checked 10 Oct 2026).
5. Review sharing: Safety Check on iPhone, Location Sharing and Security Checkup on Google Apple Personal Safety Guide: Safety Check (checked 10 Oct 2026) Google Maps Help: location sharing (checked 10 Oct 2026) Google Security Checkup (checked 10 Oct 2026).
6. Check forwarding and mirroring for calls, texts and email Apple Personal Safety Guide: forwarding settings (checked 10 Oct 2026) Gmail Help: automatic forwarding (checked 10 Oct 2026) Apple Personal Safety Guide: iPhone Mirroring (checked 10 Oct 2026).
7. Look for profiles, admin apps and unknown apps, and remove them when it is safe Apple Personal Safety Guide: configuration profiles (checked 10 Oct 2026) Android Developers: device administration (checked 10 Oct 2026) Google Play Help: Play Protect (checked 10 Oct 2026).
8. Scan for trackers with the phone, then physically Android Help: find unknown trackers (checked 10 Oct 2026) EFF Surveillance Self-Defense: detect Bluetooth trackers (reviewed 15 Jul 2024).
9. Lock your carrier account against SIM changes and ports FCC 23-95, Federal Register 88 FR 85794 (8 Dec 2023).
10. If you are high-risk (journalist, activist, official) or got a threat notification, turn on Lockdown Mode or Advanced Protection and contact Access Now's helpline Apple Support: threat notifications (published 13 Aug 2026) Android Help: Advanced Protection (checked 10 Oct 2026).

Safety Net's survivor resources include a technology safety plan and guides to phones and location tracking NNEDV Safety Net: survivor resources (checked 10 Oct 2026). For a wider look at what you expose online, see our OSINT OpSec guide.

Related OSINT Tools & Guides

OSINT OpSec Password Security Ring & Sidewalk OpSec Connection Fingerprint Wireless OSINT MAC Address Lookup