Is My Phone Tapped or Being Monitored? The Checks That Actually Tell You

Something feels off. Your battery is dying faster than it should. Your phone has been warmer than usual. Your data usage spiked and you have no idea why. Any one of those on its own is probably nothing. All three together, and it's worth taking a closer look.

Modern phone monitoring rarely works the way it does in movies. There's no physical wire tap, no agent in a van. It's usually software: a spyware app installed while you weren't looking, a malicious link you tapped, or call forwarding quietly switched on without your knowledge. The good news is that surveillance software often leaves traces. You just need to know where to look.

What does it actually mean for a phone to be "tapped"?

Phone tapping used to mean a literal connection to a phone line. Today it means something different. Most modern surveillance happens through software installed on the device itself, or through your carrier's network settings being changed without your consent.

There are two main categories:

• Device-level monitoring: Spyware or stalkerware installed on your phone. These apps can record calls, capture messages, log your location, and transmit all of it to whoever planted them. According to the Coalition Against Stalkerware, stalkerware is usually installed by someone with physical access to your phone, often because they know or can guess your passcode. Spyware can also arrive through phishing links or compromised websites.
• Network-level interception: Call forwarding that reroutes your calls to another number before they reach you, or a SIM swap or port-out that hands your calls and texts to someone else. Call forwarding covers calls only, not texts, as Verizon notes. Forwarding is usually set from the handset, so someone with brief access to your unlocked phone can do it. A SIM swap or port-out happens through your carrier account and needs no access to your device, as the FTC explains.

Understanding which type you might be dealing with determines how you check for it.

Signs your phone might be monitored

No single sign is proof, and the signs are not conclusive. The Coalition Against Stalkerware says many stalkerware apps run without any visible signs, and NNEDV Safety Net says detection is difficult. The FTC says the most telling clue is often behavioral: another person knows things about your location, conversations, or contacts that they shouldn't. A cluster of these signs, especially if they appeared suddenly with no obvious explanation, is a reason to run the checks in the next sections.

Faster battery drain. Monitoring apps can use power in the background, and the FTC lists faster battery drain as a possible sign. If your battery started dying mid-day when it used to last all day, and your usage habits haven't changed, that's worth investigating. Check Settings > Battery on iPhone or Settings > Battery > Battery usage on Android to see which apps are using the most power.

Phone running warm when idle. The FTC lists overheating as a possible sign. Plenty of ordinary things warm a phone, though, including charging and hot weather, so treat this as a weak signal on its own.

Unexplained data spikes. The FTC lists unexpected data use as a possible sign. Monitoring apps send what they collect to a remote server, and that can show up in your data usage. On iPhone, go to Settings > Cellular (or Mobile Data). On a Pixel, go to Settings > Network & internet > SIMs > App data usage. On a Samsung Galaxy, go to Settings > Connections > Data usage. Look for anything unfamiliar.

Apps you didn't install. Stalkerware can have an innocent-looking name such as "System Service," as the FTC notes. Scroll through your full app list and flag anything you don't recognize.

Unexpected restarts. The FTC also lists unexpected restarts as a possible sign.

Someone knows too much. If another person seems to know your location, who you've been talking to, or what you've been doing online, that's one of the clearest clues, according to the FTC and NNEDV.

Strange sounds on calls. Clicks, echoes, or static during calls are not a reliable sign of tapping. Call quality problems have plenty of innocent explanations, such as a weak signal, so don't treat noise alone as evidence. Behavioral clues and checks of your settings and apps are more useful.

The diagnostic codes that check your network settings

These are not hacks or workarounds. They're standard GSM service codes (often called USSD or MMI codes) that many carriers and phones support. Support varies, though. Verizon documents 72 and 73 for call forwarding instead, and T-Mobile documents its own codes, so check your carrier's instructions if a code doesn't work. These codes only check call forwarding. They can't detect spyware installed on the phone itself.

The codes ask your carrier's network for its current forwarding settings, which are stored on the network side. Your phone still displays the result, though, so a compromised phone can't be fully trusted to show you an honest answer.

Open your phone's dialer and try these:

What a clean result looks like: "Not forwarded" or "Disabled". Many phones show your voicemail number for the busy and unreachable checks, which is usually normal.

If you find forwarding you didn't set up, dial ##002# to clear it, then call *#21# again to confirm it's gone. Be aware that ##002# clears all forwarding, which may include the forwarding your voicemail relies on, so test your voicemail afterward and call your carrier if it stops working. Contact your carrier to find out how the forwarding was set up in the first place.

How to do a deeper check on iPhone

If the forwarding codes come back clean but you still have concerns, these steps go further.

Run Safety Check. Go to Settings > Privacy & Security > Safety Check. Apple's Safety Check lets you review and stop sharing with people and apps, and review the devices signed in to your Apple Account. It needs iOS 16 or later.

Check for unknown profiles. Go to Settings > General > VPN & Device Management. Profiles are normally used by schools and businesses, and they can manage settings and some device functions, as Apple explains. If you see one you don't recognize, and the phone isn't managed by a school or employer, it may be worth deleting. Deleting a profile someone else installed could alert them, so read the safety note in the last section first.

Review app permissions. Go to Settings > Privacy & Security. Check which apps have access to your microphone, camera, location, and contacts. Revoke access for anything that doesn't need it for its core function. You can also turn on the App Privacy Report (Settings > Privacy & Security > App Privacy Report) to see which apps used your microphone, camera, or location over the past seven days.

Check your Apple Account devices. Go to Settings > [Your Name] and scroll down. You'll see every device signed in to your Apple Account. Remove anything you don't recognize, as Apple describes.

Watch the indicator dots. Apple says an orange dot means an app is using the microphone, and a green dot means it's using the camera (or the camera and microphone together). If a dot appears when you haven't opened an app that would use them, review your app permissions.

Know about Lockdown Mode. Lockdown Mode is an optional extreme setting for people at risk of targeted attacks, and it blocks installing configuration profiles. Most people are never targeted.

How to do a deeper check on Android

Check Device admin apps. On a Pixel, go to Settings > Security > Advanced security settings > Device admin apps, per Google. On a Samsung Galaxy, search Settings for "Device admin apps." Any app with administrator access that you didn't grant has more control over your phone than it should.

Review app permissions. Go to Settings > Apps, then check permissions for anything unfamiliar. Pay close attention to microphone, camera, location, and contacts access.

Check the Privacy dashboard. On Android 12 and later, a green indicator appears at the top right when an app uses the camera or microphone, as Google explains. Go to Settings > Security and privacy > Privacy dashboard to see which apps used them recently, according to Google.

Check data usage by app. On a Pixel, go to Settings > Network & internet > SIMs > App data usage. On a Samsung Galaxy, go to Settings > Connections > Data usage. Look for apps consuming mobile data in the background that you don't use or don't recognize.

Look for apps installed from unknown sources. Go to Settings > Apps > Special app access > Install unknown apps, per Google. On a Samsung Galaxy, search Settings for "Install unknown apps." The Coalition Against Stalkerware says Android stalkerware is typically installed from outside the official app store, so any app with permission to install software from outside the Play Store deserves a closer look.

Check your Google Account devices. Go to myaccount.google.com > Security > Your devices > Manage all devices. Sign out any device you don't recognize, as Google describes.

What to do if you find something

First, a safety note. If you think someone you know may be monitoring you, removing software or changing settings can alert them, and it can delete evidence. If you may be in danger, the FTC, NNEDV Safety Net, and the Coalition Against Stalkerware advise talking to a domestic violence advocate before you change anything, from a device the other person can't see. In the US, the National Domestic Violence Hotline is available at 800-799-7233, or you can text START to 88788. If you are in immediate danger, call 911.

If you found unauthorized call forwarding: Dial ##002# to clear it, then test your voicemail and contact your carrier. Ask them to check for any recent account changes, especially ones you didn't make. Set a PIN or password on your carrier account, and turn on your carrier's SIM and port-out protection, such as Verizon SIM Protection, AT&T Wireless Account Lock, or T-Mobile SIM Protection and Port Out Protection. The FTC advises using an authenticator app or security key instead of text-message codes where you can.

If you found a suspicious app: Take a screenshot first for documentation, then, if it's safe to do so, remove it. Change your passwords from a different device afterward, because passwords entered on a compromised phone may already be captured.

If you're unsure: A factory reset may remove spyware, according to the FTC, but a new phone with accounts the other person can't access is the safest option. If you do reset, don't restore apps from a backup, since that could reinstall the problem. Back up only your contacts and photos first. If someone has your iCloud or Google login, they may not need spyware at all, so change your account passwords and turn on two-factor authentication from a safe device, and review the devices signed in to your accounts.

Ongoing protection: Keep your phone's software updated, use a strong, unique passcode, and never leave your phone unlocked and unattended, since NNEDV says almost all phone stalkerware needs physical access. Be careful with links in texts and emails, even from people you know, because phishing links and compromised websites are among the main remote ways spyware reaches a phone, as the Coalition Against Stalkerware notes.

Conclusion

No single sign proves a phone is tapped or monitored, and noises on a call aren't a reliable clue. Check your forwarding settings, review your apps, permissions, and signed-in devices, and if you may be in danger from someone you know, talk to an advocate before changing anything.

Guardio doesn't detect stalkerware or wiretaps, but it covers related risks. Email Security flags phishing emails that get past the Gmail spam filter, Identity Breach Monitoring checks whether your email address or phone number shows up in a known data breach, and browsing protection on your computer and phone blocks phishing and scam sites before they open and explains why. On iPhone, the Text Message Filter sends malicious texts to junk. No tool catches everything.

Get a free security scan with Guardio today and stay protected from phishing.