A hot battery or a slow phone is not proof of hacking. Most of the time it is an update, a game or a weak signal. Real spyware leaves different traces: it needs powers on your phone, and Android shows those powers in Settings. Here are nine signs worth checking, and what to do about each one.
The 9 signs that really matter
1. An app you don’t recognise can control your screen
Android’s Accessibility feature exists to help people with disabilities. An app with it can read what is on your screen and tap buttons for you. Android’s own documentation says such a service can “retrieve window content” and “perform actions”. Spyware loves this power.
Check: Settings → Accessibility → Downloaded apps. Every app listed there should be one you chose.
2. An unknown app can read all your notifications
Notification access lets an app read every message preview, including one-time codes from your bank.
Check: Settings → Apps → Special app access → Notification access (names differ a little by phone maker).
3. An app you didn’t add is a “device admin”
Device admin apps can lock or wipe the phone and are harder to uninstall.
Check: Settings → Security → Device admin apps.
4. Your phone says it is “managed by your organisation”
On a company phone that is normal. On a personal phone you set up yourself, a device owner, profile owner or a work profile you never created means someone else can manage the phone.
5. There is a certificate you didn’t install
A “user” certificate can let someone read your secure (HTTPS) traffic. Android often shows a warning that the network “may be monitored”.
Check: Settings → Security → Encryption & credentials → User credentials.
6. A VPN you didn’t set up
A key icon in the status bar means a VPN is active. Make sure it is an app you chose, such as your firewall or your own VPN service.
Check: Settings → Network & internet → VPN.
7. Chat apps or browsers may install apps
The “Install unknown apps” permission lets an app install other apps outside Google Play, a common way for malware to arrive.
Check: Settings → Apps → Special app access → Install unknown apps, and switch it off for anything that doesn’t need it.
8. Sign-ins you don’t recognise
If someone has your Google password, they don’t need to hack the phone at all. Open the Google Security Checkup and look at recent activity and signed-in devices.
9. An app uses data while you don’t use it
Spyware has to send what it collects somewhere. Look for apps with high background data use in Settings → Network & internet → Data usage, or use a firewall that shows every connection per app.
What to do, step by step
- Update Android and your apps. Security updates close holes that spyware uses.
- Run Google Play Protect (Play Store → profile → Play Protect → Scan).
- Remove the powers you didn’t give, then uninstall the app: Accessibility, notification access, device admin, unknown certificates and VPNs from the checks above.
- Change your Google password and turn on 2-Step Verification.
- If nothing helps, back up your photos and contacts and do a factory reset as the last step.
Safety note: if you think a partner or family member put spyware on your phone, removing it may alert them. Think about your safety first; the Coalition Against Stalkerware has guidance and support contacts.
How TacUNS helps you check
- Agent Powers lists every app that can control the screen, read all notifications or act as device admin, in one place.
- App risk (version 2.0.1) shows if someone else manages the phone, a work profile, or a user-added certificate, and rates apps whose powers and network behaviour together look risky. One tap quarantines an app.
- TacUNS TrapLink places one decoy link in a notification. If any app opens it, that app read your notifications and acted on them.
- Activity shows which app connected where, and when, so a hidden app sending data stands out.
Everything is checked on the phone; nothing is uploaded. See all TacUNS features.