Smartphones have become one of the most important repositories of personal and professional information.
Messages, calls, photographs, location data, credentials, documents and browsing activity can all be stored or accessed through a single device. For this reason, smartphones have also become valuable targets for cybercriminals, surveillance operators and spyware developers.
A common question is:
How can I tell if my phone is being tracked?
The answer is more complicated than looking for one suspicious symptom.
Modern spyware can operate discreetly, sometimes collecting sensitive information while leaving little visible evidence. Documented cases involving Pegasus, Predator and Graphite have demonstrated that highly invasive spyware can compromise mobile devices and access information such as messages, location data, files, calls, camera and microphone data.
At the same time, many symptoms commonly associated with spyware — such as battery drain, overheating or increased data usage — can have completely legitimate explanations.
The correct approach is therefore not to assume that every anomaly means surveillance, but to understand which indicators deserve investigation and how to perform a structured security assessment.
Why Is It Difficult to Know If a Phone Is Being Tracked?
Modern mobile threats are specifically designed to remain difficult to detect.
Traditional malware may produce obvious symptoms, while sophisticated spyware can attempt to minimize its impact on normal device operation.
The Citizen Lab has documented cases in which mercenary spyware such as Pegasus and Predator was found on mobile devices after forensic analysis. In one documented case, the same iPhone was found to have been compromised by both Pegasus and Predator.
Amnesty International's Security Lab has likewise documented highly invasive spyware systems capable of accessing sensitive information and operating covertly on mobile devices.
Recent cases involving Graphite have also demonstrated that mobile spyware remains a current security concern rather than a purely historical threat. ANSA reported in 2026 on forensic findings concerning Android devices associated with the Graphite spyware case in Italy.
This means that there is no universal "spyware symptom".
A device should instead be evaluated by considering multiple indicators, the applications installed on it, permissions, software versions, account security and the context in which suspicious behavior occurs.
The Most Common Signs That a Phone May Be Compromised
- Rapid Battery Drain
A sudden reduction in battery life can have many explanations.
Operating system updates, demanding applications, background synchronization and battery degradation can all increase power consumption.
However, software continuously operating in the background can also consume additional processor, memory and network resources.
Battery drain should therefore be treated as an indicator to investigate, not as proof that a phone is being monitored.
- Unexplained Overheating
A smartphone that becomes unusually warm while it is idle or performing only basic tasks may deserve closer attention.
Background processes can continuously use system resources.
This does not automatically mean spyware is present. However, persistent unexplained activity becomes more significant when it appears together with other anomalies.
The Citizen Lab has documented a real spyware investigation in which the target noticed that the phone was "running hot" before forensic analysis confirmed both Pegasus and Predator infections.
- Unusual Mobile Data Usage
Some surveillance tools periodically communicate with remote infrastructure and transmit information collected from the device.
An unexpected increase in mobile data consumption can therefore be worth investigating.
However, streaming, cloud synchronization, application updates and other legitimate services can produce exactly the same symptom.
Android provides tools for reviewing application and system resource usage, making it possible to compare current behavior with normal patterns.
- Unknown Applications
One of the simplest checks is to review the applications installed on the smartphone.
Applications that you do not remember installing, applications with unclear names or software whose purpose you cannot identify deserve further investigation.
An unfamiliar application is not necessarily malicious. It may be part of the operating system, installed by the manufacturer or managed by an organization.
The important question is:
Why is this application installed, and what can it access?
ENISA recommends installing applications from trusted sources and checking both the application and its requested permissions before installation. Its recent mobile-malware guidance also recommends using a mobile security solution capable of detecting malware, spyware and malicious applications.
- Unusual Permission Requests
Permissions are particularly important because they determine which sensitive resources an application can access.
An application requesting access to the microphone, camera, location, contacts, SMS or other sensitive information should have a legitimate reason for doing so.
Android's official documentation explains how permissions protect access to restricted data and actions and emphasizes requesting only the permissions an application actually needs.
OWASP similarly considers excessive access to sensitive resources an important mobile privacy and security concern.
- Unexpected Smartphone Behavior
Unexpected restarts, freezes, slowdowns, unusual notifications or applications opening without interaction can have many causes.
They may result from:
software bugs;
operating system updates;
hardware problems;
poorly optimized applications;
insufficient system resources;
malicious software.
A single symptom therefore has limited diagnostic value.
Multiple persistent anomalies occurring together deserve much greater attention.
How Can I Check If Spyware Is Installed?
If you suspect that your smartphone may be monitored, the first step should be a structured security assessment rather than immediately assuming that spyware is present.
Start by reviewing the applications installed on the device.
Then review the permissions granted to each application, paying particular attention to:
microphone;
camera;
location;
SMS;
contacts;
files and other sensitive information.
Android also provides system-level privacy and security controls that can help users understand which applications are accessing sensitive resources.
Next, examine:
battery consumption;
mobile data consumption;
recent application activity;
operating system version;
security update status.
Keeping Android and applications updated is particularly important because vulnerabilities in outdated software can provide opportunities for attackers.
ENISA's current mobile-malware guidance recommends keeping devices protected, installing applications from trusted sources, checking permissions and using mobile security solutions capable of detecting malware and spyware.
For a practical step-by-step guide, see:
How can I tell if my phone is being tracked.
For additional information about Android spyware detection, see Android Spyware Detection.
Sophisticated Spyware Can Operate Without Obvious Symptoms
One of the most important distinctions in mobile security is between ordinary malware and highly targeted surveillance tools.
Some spyware campaigns use phishing messages or malicious applications.
CISA documents mobile attack techniques involving phishing, Trojanized applications and spyware such as Pegasus and Intellexa. These attacks can provide access to sensitive information including call logs and geolocation data.
Other spyware has exploited vulnerabilities in operating systems or applications.
Amnesty International and Citizen Lab have documented cases involving both one-click and zero-click exploitation techniques, demonstrating that some highly targeted attacks do not necessarily depend on the victim knowingly installing an application.
This is why simply asking:
"Do I have an unknown application installed?"
is not sufficient to assess every possible form of mobile compromise.
Why a Factory Reset Is Not Always the First Answer
A factory reset is often considered the obvious solution when someone believes a phone is being monitored.
It is not necessarily the first step.
Before resetting a device, it can be useful to understand what happened, review applications and permissions, update the operating system and perform a security assessment.
A reset may be appropriate in certain situations, but it does not automatically solve every underlying security problem.
For example, if the original problem involved compromised account credentials, phishing, malicious links or another security weakness, resetting the device alone may not address the broader attack path.
The objective should therefore be to understand the source of the compromise, not simply to remove its visible consequences.
How to Protect a Phone From Future Monitoring
The best defense against spyware is a layered security strategy.
- Keep Android Updated
Operating system and application updates should be installed as soon as practical.
Security updates address vulnerabilities that attackers may otherwise exploit.
Android's security documentation provides guidance on application risks, secure platform interaction, data protection and other aspects of mobile security.
- Install Applications Carefully
Applications should preferably be downloaded from trusted sources.
Before installing an application, consider:
who developed it;
what it does;
its reputation;
the permissions it requests;
where it was obtained.
ENISA specifically recommends trusted application sources and reviewing permissions before installing mobile applications.
- Avoid Suspicious Links and Attachments
Unsolicited SMS messages, emails and other communications can be used to deliver malicious links or applications.
CISA identifies phishing through mobile messaging and Trojanized applications among techniques used to compromise mobile devices.
- Protect Access to the Device
Use a strong screen lock and enable multi-factor authentication for important accounts whenever possible.
Physical access to an unlocked smartphone can also create opportunities for unauthorized changes or software installation.
- Review Permissions Regularly
Permissions should not be treated as a one-time configuration.
Review which applications can access sensitive resources and remove access that is no longer necessary.
This follows the principle of least privilege that is central to secure mobile application design and platform security.
- Protect Sensitive Communications
Device security is only one part of the problem.
If a smartphone is used to exchange sensitive information, communications themselves also need protection.
Messages, calls and files can become valuable targets independently of the underlying operating system.
A secure communication app or a secure messaging platform can therefore be part of a broader strategy for reducing communication-interception risks.
Phone Security Requires More Than One Tool
A common mistake is to search for a single application that can answer the question:
"Is my phone being tracked?"
Modern mobile security does not work that way.
A more effective strategy combines several layers:
operating-system security;
application security;
permission management;
security updates;
malware and spyware detection;
strong authentication;
phishing protection;
secure communications;
appropriate organizational controls.
ENISA has long emphasized that smartphones contain highly sensitive personal and business information and require a combination of security measures rather than a single protective mechanism.
Its more recent threat landscape also identifies mobile devices as high-value targets and highlights vulnerabilities and malicious applications among important attack vectors.
When Smartphone Security Becomes an Organizational Issue
For an individual, a compromised smartphone can expose:
personal messages;
photographs;
credentials;
contacts;
location;
documents;
account information.
For an organization, the consequences can be much broader.
A compromised smartphone may become an entry point into corporate accounts, sensitive communications or other organizational resources.
This is why mobile devices should be considered part of the broader cybersecurity architecture.
For organizations handling sensitive information, mobile threat defense, secure communications, endpoint security and appropriate device-management policies can complement traditional cybersecurity controls.
ENISA has specifically highlighted the importance of secure smartphone development, sensitive-data protection, authentication, authorization, secure communications and privacy protection in mobile environments.
Final Thoughts
So, how can I tell if my phone is being tracked?
There is no single symptom that can provide a definitive answer.
Rapid battery drain, overheating, unusual data consumption, unknown applications, unexpected permissions and abnormal device behavior can all justify further investigation — but they can also have completely legitimate explanations.
The right approach is therefore to consider multiple indicators together and perform a structured security assessment.
Keeping Android updated, reviewing application permissions, installing software from trusted sources, protecting accounts with strong authentication and being cautious with unsolicited messages can reduce the risk of compromise.
For highly sensitive use cases, however, device security should be considered together with communication security.
The objective is not simply to determine whether a phone is being tracked after something goes wrong. It is to build a mobile environment in which unauthorized access, surveillance and interception are substantially harder to achieve.
For a practical guide to checking the most common warning signs and reviewing an Android device, see:
How can I tell if my phone is being tracked.
Sources and Further Reading
Institutional and cybersecurity sources
CISA — Guidance for Civil Society: Mitigating Cyber Threats with Limited Resources — mobile initial access, phishing, Trojanized applications and spyware including Pegasus and Intellexa.
ENISA — Mobile Malware: Tips & Advice to Protect Yourself — trusted application sources, permissions, updates and mobile security solutions.
ENISA — Threat Landscape 2025
— current European threat landscape, including mobile devices, vulnerabilities, malicious applications and phishing.ENISA — Smartphone Security Risks and Opportunities
— risks involving spyware, malicious applications, sensitive data and smartphone security.
Technical and forensic research
- Citizen Lab — Pegasus vs. Predator — forensic investigation documenting simultaneous Pegasus and Predator infections on a mobile device.
- Citizen Lab — The Predator in Your Pocket — research into spyware capabilities including monitoring communications, location, microphone and camera access.
- Amnesty International Security Lab — Predator Files — technical analysis of Intellexa's Predator spyware and its infrastructure.
- Amnesty International Security Lab — The Pegasus Project — forensic investigations into Pegasus infections and zero-click attacks.
Android security
- Android Developers — Permissions on Android — official documentation on Android permissions and access to sensitive resources.
- Android Developers — Privacy and Security — official Android privacy and security guidance.
- OWASP Mobile Application Security Verification Standard (MASVS) — mobile application security and privacy controls.
News and current cases
- ANSA — È davvero possibile clonare un telefono? — explanation of smartphone compromise, SIM swap and spyware.
- ANSA — Cos'è Graphite e cosa è capace di fare lo spyware dell'azienda israeliana Paragon — background on Graphite and its capabilities.
- ANSA — Caso Paragon, l'atto di accusa dei pm: spiati tre telefoni — 2026 reporting on forensic findings involving Graphite and Android devices in Italy.
Practical resource
- Secure Phone Messaging — How can I tell if my phone is being tracked? — practical guide to smartphone monitoring indicators, Android checks and security practices.
Blowfish resources
- Android Spyware Detection — Blowfish resource on detecting Android spyware.
- Secure Android Messaging App — Blowfish resource on secure communications. Smartphone Interception Protection — Blowfish resource on interception risks.
