How to Tell If Your Android Phone Is Hacked, and How to Take It Back

By Chris Clark, founder of Senior Tech Cafe

Here’s how to tell if your phone is hacked: look for changes you didn’t make, such as apps you didn’t install, messages you didn’t send, settings that moved on their own, or accounts that suddenly lock you out. A warm phone or a tired battery on its own usually means an old phone, not a hacker.

That matters, because your phone holds your family chats, your banking secrets and that list of things you searched for at 2 a.m. (Do penguins have knees?) When it starts acting possessed, you want to know whether it’s a glitch or a break-in.

Below are the signs worth worrying about, what to do in what order if someone did get in, and how to keep them out next time.

Can an Android Phone Be Hacked? (Spoiler: Yes)

It’s a lazy Sunday afternoon, and you’re scrolling through photos of your grandkids when the phone starts heating up like it’s trying to fry an egg. Or your data usage spikes, and you wonder whether your phone is moonlighting as a video streamer.

Sometimes that’s just a phone being a phone. Sometimes it’s a hacker’s handiwork. Most break-ins need a little help from you, which means you can refuse to give it. The usual ways in are:

• A shady link in a text or email (“Congratulations! You’ve won a cruise!”).
• A fake app, especially one installed from a link instead of the Google Play Store.
• A stolen password for your Google account.
• A SIM swap, where a scammer talks your phone company into moving your number to their phone so they get your texts and codes.

Once inside, they’re like unwanted houseguests rummaging through your personal data and passwords.

How to Tell If Your Phone Is Hacked: The Signs to Watch For

To tell if your phone is hacked, look for several of these signs at once: apps you didn’t install, pop-ups that won’t stop, friends getting messages you didn’t send, accounts locking you out, or Google Play Protect warning you about an app. One sign alone, like a hot phone, is usually innocent. Two or three together deserve action.

Think of your phone as a reliable old car. When it starts sputtering or guzzling gas, you know something’s up. Here’s what the sputtering looks like on Android:

Your Battery Is Draining Faster Than Your Retirement Account

One day your phone lasts all day; the next, it’s crying for a charge by lunchtime.

A sudden battery drain can mean a harmful program is running nonstop in the background, sending your data to parts unknown. It can also mean an aging battery. Open Settings and look at the battery usage screen to see which apps are using the most power. If the top one is an app you don’t recognize, that’s your suspect.

Data Usage Higher Than Your Grandkid’s College Tuition

Mystery Apps That Weren’t Invited to the Party

Pop-Up Ads That Multiply Like Rabbits

Your Phone Suddenly Has No Service

If your phone suddenly can’t make calls, send texts or use mobile data, and you’re somewhere it normally works, call your phone company from another phone right away. That’s the classic sign of a SIM swap: a scammer has convinced your carrier to move your number to their phone, so your texts and security codes go to them. It’s especially worrying if password-reset emails start arriving at the same time.

Play Protect Warns You About an App

Google Play Protect is the security scanner built into Android phones that use Google Play. If it sends you a notification about a harmful app, believe it. Tap the notification and tap Uninstall. Play Protect sometimes turns the app off or removes it for you, and tells you it did.

Why a Hacked Phone Is Serious Business

Think of your phone as a treasure chest. If a hacker gets in, they’re not just swiping a few gold coins. They could:

• Get at your money: A phone that’s already signed in to your bank or email can be used to read security codes and reset passwords.
• Spy on your life: Some harmful apps can read your texts, track your location, or use your camera and microphone. (No more singing to your plants in peace.)
• Steal your identity: With your personal details in hand, crooks can pretend to be you, open accounts in your name, or message your friends asking for money.

That’s why the steps below start with your passwords and your bank, not the phone itself.

What to Do If Your Phone Is Hacked

If your phone is hacked, cut it off from the internet, secure your Google account from a different device, warn your bank, and then clean up the phone. Do these steps in this order.

Step 1: Disconnect the Phone

Swipe down from the top of the screen and turn on Airplane mode, or turn off Wi-Fi, mobile data and Bluetooth. Without a connection, a harmful app can’t send your information anywhere.

Step 2: Secure Your Google Account From Another Device

Use a computer or another phone you trust, not the one you think is hacked. Change your Google account password first, because that account controls your Android phone, your Gmail and your saved passwords. Then, in your Google account, check Recent security events under Security & sign-in, and sign out any device you don’t recognize under Your devices, then Manage devices. After that, change your email and bank passwords.

Step 3: Call Your Bank and Warn Your Friends

If banking or payment apps are on the phone, call your bank using the number on the back of your card and tell them your phone may be compromised. If the phone suddenly lost service, call your phone company too and ask whether your SIM was changed. Then let friends and family know that any odd message from you asking for money or help isn’t from you.

Step 4: Delete Apps You Don’t Recognize

Open Settings, tap Apps, and look through the full list (you may need to tap See all apps). Tap any app you don’t remember installing and choose Uninstall, then restart the phone. If an app won’t uninstall or keeps coming back, restart the phone in safe mode, which turns off downloaded apps, and remove it from there. How to start safe mode varies by phone, so check your phone maker’s support site.

Step 5: Run a Security Scan

Reconnect to your home Wi-Fi. Open the Google Play Store app, tap your profile picture at the top right, tap Play Protect, then tap Scan. You can also run a full scan with a reputable security app from the Play Store, such as Bitdefender, Norton or Avast, and follow its instructions to remove anything it finds.

Step 6: Factory Reset, as a Last Resort

If the problems keep coming back, a factory reset erases everything on the phone, including whatever got in. Before you start:

• Back up your photos, contacts and anything else you can’t live without to your Google account.
• Make sure you know the Google account and password on the phone. You’ll need them after the reset.
• If you changed your Google password in step 2, wait 24 hours before resetting. Google recommends it.
• Charge the phone to at least 70 percent. A reset can take up to an hour.

Then open Settings, search for reset, and choose the factory reset option. Menu names vary by phone, so your phone maker’s support site has the exact steps.

Keeping the Hackers Out

Now that you’ve kicked the hackers to the curb, it’s time to fortify your phone like a medieval castle, moat optional. These eight habits close the doors they use most.

2. Use Strong Passwords

Use a different password for every important account, especially your Google account and your bank. A long phrase, like “MyDogHatesMondays”, beats a short jumble you’ll forget by Thursday.

A password manager keeps track of them for you, and there’s a good free one.

4. Be Careful on Public Wi-Fi

Public Wi-Fi is convenient, but you can’t tell who runs it or who else is on it. For banking and anything with a password, switch to your phone’s mobile data instead. If you use public Wi-Fi often, a VPN scrambles your connection so other people on the network can’t read it.

5. Download Apps Carefully

Only download apps from the Google Play Store. Installing an app from a link in a text or email is the digital equivalent of accepting candy from a stranger. Check the reviews and the developer’s name before you tap Install, and keep Play Protect switched on. It’s on by default, and Google recommends leaving it that way.

6. Lock Down Your Phone Number

A SIM PIN makes your phone ask for a code when it restarts, so a thief who steals the phone can’t pull out the SIM card and use your number in another one. You’ll find it in Settings under security, usually called SIM lock. Write the PIN down: a few wrong tries can lock the SIM until your carrier unlocks it.

A SIM PIN doesn’t stop a SIM swap, though, because that happens at your phone company. For that, call your carrier or open its app and ask about locking your number so it can’t be moved to another phone or carrier without your OK. Verizon, T-Mobile and AT&T all offer free protection like this.

7. Think Before You Click

8. Consider a Security App

Play Protect is already on your phone. A good security app adds a second watchdog that can also block dangerous links and warn you about scam sites.

Our favorite (and the one I personally use) is Bitdefender. Whatever you choose, download it from the Google Play Store and check the developer’s name, because fake “security” apps are one of the favorite disguises for the very thing you’re trying to keep out.

Keep Your Digital Door Locked

Most hacked phones were let in by a link, an app or a stolen password, so a few habits keep most of them out: current updates, apps from the Play Store, and two-factor authentication on your Google account.

And if something seems fishy, it probably is. Trust your instincts the way you would in the physical world. If you’ve already clicked something you shouldn’t have, here’s what to do after clicking a suspicious link. For the rest of the checklist, start with our online safety guide for seniors.

Questions About a Hacked Android Phone

Does Android Have Built-In Virus Protection?

Yes. Google Play Protect comes with Android phones that use Google Play and is switched on by default. It checks apps before you download them, scans your phone for harmful apps from any source, and can warn you, disable an app or remove it. It’s good, but brand-new threats can slip past it for a while.

Will a Factory Reset Get Rid of a Hacker?

A factory reset erases every app and file on the phone, including harmful ones. It doesn’t fix stolen passwords, so change your Google password from another device first. Google advises waiting 24 hours after a Google password reset before factory resetting, and making sure you know that account’s password, because you’ll need it afterward.

What Should I Do First If My Phone Is Hacked?

If your phone is hacked, first switch on Airplane mode to cut its connection. Then, from a different device, change your Google account password and check its list of signed-in devices. If banking apps are on the phone, call your bank using the number on your card. After that, remove unfamiliar apps and run a Play Protect scan.