Signs Your Android Phone Has Been Hacked: What to Do

Reading is great. Tracking makes it stick. Sign up for a free Dashboard to tick off tasks and see your Security Score.

Get my free Dashboard →

Cyber Nova AI helps you prepare for Cyber Essentials. It doesn't award or certify it. Follow the steps here to get ready, then apply for certification through an accredited Cyber Essentials body when you're set.

Signs your Android may be compromised

These can indicate malware or unauthorised access, though some have innocent causes too:

Battery draining significantly faster than usual without a change in your usage
Phone running hot when idle
Unexpected data usage: check Settings > Network > Data usage
Apps you do not recognise in Settings > Apps
Emails or messages sent from your accounts that you did not send
Friends reporting unusual messages from your number or accounts
New accounts appearing in Settings > Accounts that you did not add
Your Google account shows sign-ins from unknown locations

8 steps

Immediate steps: secure your accounts

Start with your Google account: it is the master key to everything on your Android:

Change your Google account password immediately from a different device, a laptop or another phone
Enable two-factor authentication on your Google account if not already active
Sign out of all devices: myaccount.google.com > Security > Your devices > Sign out of all other devices
Change passwords for any other accounts you accessed on the phone, starting with banking and email
Contact your bank immediately if you accessed banking apps on the device

5 steps

Check and clean your device

Once you have secured your accounts, check the phone itself:

Run Google Play Protect: Google Play > Profile > Play Protect > Scan
Go to Settings > Apps and look for apps you do not recognise: uninstall anything suspicious
Check Settings > Accessibility > Installed services: malware sometimes uses accessibility services
Check Settings > Device admin apps: legitimate apps rarely need device admin access; remove anything unexpected
Remove any Google accounts you do not recognise from Settings > Accounts

5 steps

Factory reset as a last resort

If you cannot identify and remove the problem, a factory reset wipes everything and starts fresh:

Backup contacts and photos first: a backup made while the phone is compromised may back up the threat too
To factory reset: Settings > System > Reset > Factory data reset
After reset, restore from a backup made before the incident if possible
Re-install only the apps you genuinely need
Report to Report Fraud if you have lost money or personal data: reportfraud.police.uk

5 steps

Track your Android security progress. Free.

Create a free account to tick off tasks, see your Security Score improve, and know exactly what you've done and what's still to do.

Start your free security check

What to do if your Android is hacked

Signs your Android may be compromised

Immediate steps: secure your accounts

Check and clean your device

Factory reset as a last resort