For most people, the phone is the key to everything: UPI and banking, email, WhatsApp, photos and work. That makes it the main target for criminals. The good news is that a few simple settings block the vast majority of attacks.
Signs your phone may be hacked
- Apps you don't remember installing, especially with device-admin or accessibility permissions
- Battery draining or the phone heating up when idle
- Unexpected data use, pop-up ads or the browser opening on its own
- Messages or posts sent that you didn't write
- Account alerts about logins from new devices or locations
- Someone knowing things about your messages or location they shouldn't
The 15-minute security checklist
| Setting | Android | iPhone |
|---|---|---|
| Software updates | Settings → System → Software update | Settings → General → Software Update |
| Screen lock | PIN or password + fingerprint/face | Passcode + Face ID / Touch ID |
| App safety | Keep Google Play Protect on; don't allow “unknown sources” | Install only from the App Store |
| Find / erase phone | Find My Device | Find My iPhone |
| Backups | Google backup for photos and data | iCloud backup |
Check app permissions
- Open the permission manager (Android: Settings → Security & privacy → Privacy → Permission manager; iPhone: Settings → Privacy & Security).
- Review which apps can use the camera, microphone, location, SMS and contacts.
- Remove permissions that an app doesn't need, and uninstall apps you no longer use.
- On Android, check which apps have accessibility or device-admin access – malware often abuses these.
Protect the accounts on your phone
- Turn on two-factor authentication for email, WhatsApp, Instagram, Facebook and banking
- Use a password manager instead of reusing passwords
- Never share OTPs or install apps sent by strangers – see common online scams
- Avoid banking on public Wi-Fi; use mobile data instead
If you think your phone is compromised
- Disconnect from Wi-Fi and mobile data if you see active misuse.
- From another, trusted device, change your email and banking passwords.
- Remove suspicious apps, update the phone, and run Play Protect.
- If problems continue, back up photos and contacts, then do a factory reset – and don't restore suspicious apps.
Tinos offers personal phone and laptop security checks as part of our personal cyber security services, and cyber security for businesses. If an account has already been taken over, read what to do if your account is hacked.
Frequently asked questions
Can a phone be hacked just by receiving a call or message?
It is rare for ordinary users. Most hacks happen through malicious links, fake apps, shared OTPs or stolen passwords. Keeping the phone updated protects against the rare advanced attacks.
Do I need an antivirus app on my phone?
On Android, Google Play Protect gives a good baseline; a reputable security app can add protection. On iPhone, keeping iOS updated and installing only App Store apps matters most.
Is a factory reset enough to remove malware?
For most phone malware, yes – as long as you update the phone afterwards and don't reinstall the suspicious apps or restore an infected backup.
