Stalkerware is designed to stay hidden. If someone installs it on your phone, you probably won’t see a suspicious app appear on your home screen or receive a warning telling you your device is being monitored.

That doesn’t mean it’s impossible to spot. While stalkerware often disguises itself or runs quietly in the background, it usually leaves behind clues in your phone’s settings, permissions, or connected accounts. Knowing where to look can help you identify whether something isn’t right.

Apps that have permissions they shouldn’t

Suspicious app names should also alert you, but they’re easier to conceal

The simplest way most stalkerware apps hide is by changing their names. Once installed, the app icon disappears from the home screen or gets relabeled as something forgettable, such as System Service, Device Health, Wi-Fi, or similar. The app keeps running in the background, but you stop seeing it or paying attention to it because it blends in, often with a familiar icon.

That means that one of the most important ways to figure out if you have a rogue spy app on your device is checking app permissions rather than names. Most stalkerware apps abuse device permissions to grant themselves access to notifications, screen recording, cameras, and microphones, or add permissions that make them extremely difficult to remove.

Abuse of Accessibility Services is particularly prominent on Android devices. In normal usage, these services help someone read what’s on the screen for screen readers and similar. But stalkerware can use the same service to access and log keystrokes, read messages inside other apps, capture camera images, and more.

How to check

To check on an Android device, head to Settings > Accessibility and check which apps have access to these functions, cross-checking the names on a separate device if possible. You could also head to Settings > Apps > Special app access and check the Device admin and Notification access section for anything you’re not sure about.

It’s a slightly different story on iPhone, as Apple doesn’t allow the same sweeping access to permissions as Android. It’s one of the reasons iPhones are generally more secure than Android devices. Still, that doesn’t mean there aren’t settings you can check.

Head to Settings > Privacy & Security and review any apps with access to:

• Location
• Services
• Camera
• Microphone
• Contacts
• Photos
• Calendars
• Bluetooth
• Local Network

On both operating systems, consider whether each app genuinely needs those permissions. A navigation app obviously needs your location, while a simple calculator probably doesn’t. An unfamiliar app doesn’t automatically mean your smartphone has stalkerware, mind, but it’s an easy place to start.

You find settings you never enabled

It’s not always app permissions

Not all stalkerware hides as a mysterious app. Sometimes the biggest clue is discovering settings you never knowingly changed. This is one of the biggest telltale signs that something is going on: apps with admin privileges, features enabled that you wouldn’t normally use, device management settings that don’t make sense, and so on.

Depending on your device operating system, this can take different forms, so I’ll break it down into some of the key areas to check on Android and iOS.

Android devices

On Android, you’re typically looking for unfamiliar apps and the signs of sideloading. Sideloading allows you to install apps outside the protection of Google Play, which, while useful at times, is a prime way stalkerware is snuck onto a device.

• Install unknown apps: Head to Settings > Apps > Special app access > Install unknown apps. Most folks have never touched this menu, so each app should be set to Not allowed.
• Google Play Protect: Head to Play Store > Profile icon > Play Protect > Gear icon and check that Scan apps with Play Protect is still switched on. Turning it off is a common first step for sideloading monitoring apps, since Play Protect is built to flag known stalkerware.
• Battery optimization exceptions: In this case, you’ll need to open Settings > Apps > [app name] > Battery > Always allow. An unfamiliar app exempted from battery restrictions can run continuously in the background without being throttled, helping it send data without issue. Note that this setting may have a different name depending on your smartphone manufacturer.

These are three of the main considerations, but you should also check your device for alternative profiles, changes to your default apps or launcher, and, in some cases, if the Developer Options and/or USB Debugging are enabled in the Settings.

iPhones

On iOS devices. you’re typically looking for account or device management settings that have been configured without your knowledge.

• Screen Time passcode: If your Screen Time has a passcode that you don’t remember setting, someone could have tampered with your phone.
• Significant Locations: Head to Settings > Privacy & Security > Location Services > System Services > Significant Locations. This feature logs your frequently visited locations, and could feed into a family/location tracking app you’re not aware of.
• Share my Location/Find My people list: This time, head to Settings > Privacy & Security > Location Services > Share My Location, and Find My > People. In both cases, check for anyone on the contacts list that shouldn’t be able to see your location, person, or app.
• Automatic Downloads: Finally, head to Settings > App Store > Automatic Downloads. If “Apps” is on and the Apple ID is shared, apps installed on one device silently appear on others. This can let someone remotely install apps on your device without you realizing.

Other checks you may want to make are for clear jailbreak indicators. While jailbreaking isn’t necessarily required to install stalkerware on iOS these days, if you find apps like Cydia, Sileo, or Zebra, your device has been jailbroken, and certain App Store restrictions have been bypassed.

That said, it’s been a long, long time since the last widespread jailbreak on iOS, and it doesn’t apply to the most recent versions of Apple’s mobile operating system.

Check your Google or Apple account

Stalkerware isn’t always an app; it’s general access

Sometimes there isn’t any spyware on your phone at all.

Many iPhone monitoring services — and a fair few Android ones — don’t bother with an app. Instead, they just log into your cloud account. If someone has your Apple ID or Google Account password, they can see your backups, location history, photos, and contacts without ever touching your handset.

That’s also why deleting a suspicious app doesn’t always fix anything. If the account itself is the access point, there’s nothing on your phone to find.

Apple

On Apple accounts, you’re looking for access indicators such as:

• Different devices signed into your Apple ID
• Text Message Forwarding that you didn’t configure
• Find My Sharing features enabled
• Family Sharing (devices you don’t recognize or at all)
• iCloud Backup access

iCloud Backup is an important one to check. If someone has access to your iCloud Backup, they can theoretically restore your backup to a device of their own. Apple’s Advanced Data Protection encrypts your backups to protect against any snooping, but also assumes you have a clean device to enable it on.

In all cases, if you don’t recognize a device, account, or sharing relationship, remove it immediately.

Google

Google accounts are looking for similar access problems:

• Different devices signed into your Google Account
• Recent Security Activity showing logins you don’t recognize
• Third Party Apps with Account Access listing apps with permission to read your contacts, emails, Drive files, and so on
• Location Sharing enabled in Google Maps and other apps that require location data

If you see a device you don’t recognize, sign it out and change your password immediately.

Your phone suddenly behaves differently from normal

Odd wake-ups, battery drain, software bugs, and more

Stalkerware apps generally have one huge giveaway: battery life. Because these apps often run nonstop in the background, the devices they’re installed on run out of juice much faster than usual.

Another one is abnormally high data usage out of the blue. A sudden uptick in data usage may coincide with the amount of data processed and sent from your device to a receiving device, indicating that something isn’t quite right.

However, it’s worth noting that these aren’t absolute smoking guns when it comes to spotting stalkerware. They’re common symptoms, no doubt, and deserve a deeper check across your device. But they’re also common side-effects of certain social media apps, software bugs, poor mobile signal, operating system updates, poorly configured/programmed apps, and so on.

Deleting unknown apps and access feels like the first thing to do

But it might not be without issue

Now, when you find anything resembling stalkerware on your device, the first instinct is to hit delete and purge everything. It feels like the safest route and like you’re taking back control. But it might not always be the best option depending on how the stalkerware ended up there.

Most stalkerware, be that an app, hidden permission, or shared access, will typically send a notification the moment it stops reporting or its access is revoked. Unfortunately, that can escalate a situation rather than end it. In some cases, it can also destroy vital evidence in the process, something that a police report might rely on later.

If possible — situational safety very much permitting — contacting the police from a completely new device may be the safest option. There are also services such as the National Network to End Domestic Violence and its Safety Net Project that are designed to help victims escape stalkerware and the associated dangers.

The National Domestic Violence Hotline (1-800-799-7233) and the Coalition Against Stalkerware are also incredibly useful support options.

Remember: installing monitoring software on someone else’s device without their consent is illegal in most places, and it’s worth getting a police report on record even if pursuing it further isn’t the plan right now.

When the time is right, and it’s safe to remove the stalkerware, a factory reset is the one method that reliably works across the board. Deleting the individual app isn’t trustworthy on its own, given how deep some of these dig into device admin and accessibility permissions. Back up what actually matters first, though — restoring from an old backup can bring the stalkerware right back with it, which defeats the point of resetting at all.