Checking your phone for spyware means running through installed apps, permission settings, battery and data usage, and device behavior — no single code or app catches everything, and stalkerware built to hide from the average user often survives a basic scan. The checks below catch most consumer-grade spyware; the gap they leave is intentional, because the tools sold to stalkers and jealous partners are designed to beat exactly these steps.
- Check installed apps, device admin permissions, and battery/data usage first — spyware hides behind generic system-sounding names.
- iOS's App Privacy Report and Android's battery stats expose apps quietly using your camera, mic, or location without you opening them.
- No dial code (*#06# or similar) detects spyware in 2026 — that claim circulates online but doesn't work on modern phones.
- A factory reset wipes software-based spyware 100% of the time but does nothing for hardware bugs planted near or on the device.
- When self-checks find symptoms but no app, a professional TSCM sweep is the next step, not another scanner app.
Why this matters
Spyware on a phone isn't always an app you can see in the app drawer. Modern stalkerware renames itself as "System Update" or a battery utility, hides its icon, and reports back through encrypted traffic that looks like normal background sync. Someone with 10 minutes of physical access to an unlocked phone can install it, and once it's running, it can pull location history, texts, call logs, photos, and in some cases live microphone audio.
The checks in this guide cover what a phone owner can verify without special equipment. USA Bugsweeps gets called in specifically for the cases where those checks come back clean but the person still has good reason to believe they're being monitored — recovered stalking victims, executives handling sensitive deals, and people who've already found a hidden GPS tracker and want to know what else might be running.
How do you check your phone for spyware?
Work through these in order. Each step takes a few minutes and doesn't require installing another app before you've ruled out the obvious.
- Review every installed app. On iOS, go to Settings > General > iPhone Storage and scroll the full list — spyware often hides among system-looking names. On Android, check Settings > Apps > See all apps, including system apps.
- Check device administrator and accessibility permissions. Spyware needs elevated permissions to survive reboots and resist deletion. Settings > Security > Device admin apps (Android) or Settings > General > VPN & Device Management (iOS) shows anything with that level of access.
- Audit battery and data usage by app. A spyware process running in the background 24 hours a day shows up as an outsized battery or data drain from an app with a vague or unfamiliar name.
- Look for unexplained heat, slow performance, or unexpected reboots. These are side effects of a process running continuously, not proof on their own, but worth tracking with the other signs.
- Check for jailbreak or root status. Most consumer spyware for iPhones requires a jailbreak to install; unexpected jailbreak or root access is a strong signal something was installed without the owner's knowledge.
| Signal | iOS location | Android location |
|---|---|---|
| Unknown apps with system-like names | Settings > General > iPhone Storage | Settings > Apps > See all apps |
| Elevated permissions | Settings > General > VPN & Device Management | Settings > Security > Device admin apps |
| Battery/data drain | Settings > Battery | Settings > Battery / Data usage |
| Camera/mic access log | Settings > Privacy & Security > App Privacy Report | Settings > Privacy > Permission manager |
iOS spyware checks
Apple's App Privacy Report, once turned on in Settings > Privacy & Security, logs every app's camera, microphone, location, and network access over the past 7 days. Turning it on after the fact only starts logging from that point forward, so it won't catch anything that happened before you enabled it — but going forward, it's the single most useful built-in tool on an iPhone for this. Verdict: enable App Privacy Report and check it weekly — free, built-in, and catches most consumer spyware behavior.
Android spyware checks
Android's battery usage screen breaks down consumption by app over the last 24 hours, which is where most spyware gets exposed — it has to run constantly to be useful to whoever installed it. Google Play Protect also scans installed apps for known malware signatures automatically, though it doesn't catch stalkerware sold specifically to evade it. Verdict: check battery usage weekly and don't rely on Play Protect alone — it misses purpose-built stalkerware.
Why spyware is hard to catch with phone checks alone
- Renamed system apps — spyware disguises its app name and icon to blend into settings menus.
- Encrypted exfiltration — data leaves through HTTPS traffic that looks identical to normal app syncing.
- Sideloaded installs — someone with brief physical access installs it outside the app store, bypassing store-level scanning.
- Root/jailbreak persistence — advanced spyware survives reboots and factory resets in rare, sophisticated cases by embedding at the firmware level.
- No universal detection code — despite what forums claim, there's no dial sequence that reveals spyware on a modern smartphone.
- Hardware bugs aren't software — a physical bug or a hidden GPS tracker on your car won't show up in any phone scan because it isn't running on the phone at all.
That last point is where phone-level checks hit their ceiling. Someone worried about being monitored across their phone, car, and home needs to treat each as a separate check, not one scan.
Can spyware be installed on a phone without touching it?
No — nearly all consumer and stalkerware spyware in 2026 requires at least brief physical access to install directly on the device, unlike phishing malware that can arrive through a malicious link. Claims of "zero-click" spyware installs exist at the nation-state level, but they're not what's used in domestic stalking or corporate espionage cases.
Does a factory reset remove spyware?
Yes — a factory reset removes software-based spyware 100% of the time because it wipes every installed app and setting back to default. It does not remove anything planted in hardware, and it also erases contacts, photos, and messages, so back up first if the phone isn't already compromised at the network level.
Is there a secret code to check if a phone is tapped?
No — codes like *#21# or *#06# circulating online don't detect spyware or wiretaps on phones released in 2026; they show basic call forwarding and IMEI status, not surveillance software. Anyone relying on these codes as proof of a clean phone is working from outdated information.
For cases involving stalking, coercive control, or an abusive partner, phone checks are only part of the picture — GPS tracker detection for domestic violence and stalking victims often turns up a vehicle tracker even when the phone itself is clean.
Get a professional TSCM sweep
Phone, vehicle, and property checks for signs consumer tools miss.
FAQ
How do I know if my phone has spyware in 2026?
Check installed apps and device admin permissions first, then review battery and data usage by app over the past 24 hours — spyware running continuously in the background is the most common tell. No single app or dial code confirms it on its own.
What is the best free way to check for spyware on an iPhone?
Apple's built-in App Privacy Report, found in Settings under Privacy & Security, is the best free option — it logs 7 days of camera, microphone, and location access per app. It's built for exactly this and requires no third-party install.
Does *#21# tell you if your phone is tapped?
No, *#21# only shows call forwarding status and does not detect spyware or wiretaps on phones in 2026. This is a persistent myth that doesn't reflect how modern surveillance software actually works.
Can antivirus apps detect stalkerware?
Some antivirus apps catch known stalkerware signatures, but purpose-built stalkerware sold to evade detection often passes through unnoticed. A clean antivirus scan is not the same as a confirmed clean phone.
Will a factory reset remove spyware from my phone?
A factory reset removes software-based spyware 100% of the time because it wipes all installed apps and settings. It won't remove hardware-level bugs and it erases personal data, so back up anything you need first.
Is it possible to have spyware and a hidden GPS tracker at the same time?
Yes, and they require separate checks — a phone spyware scan will not detect a hidden GPS tracker on your car, since the tracker isn't running on the phone at all. Anyone concerned about both needs to check the device and the vehicle independently.
Do I need a professional to check for spyware or can I do it myself?
Self-checks catch most consumer-grade spyware, but a professional TSCM sweep is the next step when symptoms persist after a clean self-check. Professional sweeps also cover hardware bugs and vehicle trackers that phone-level checks can't reach.
One last thing
The checks above only cover software running on the phone itself — they say nothing about a hardware bug planted in a car, an office, or a home, which is where a phone-focused search leaves a real gap. Someone who clears every app and permission check but still has good reason to suspect they're being monitored is usually dealing with a device that isn't the phone at all. That's the exact scenario a TSCM bug sweep is built to close, and it's a different discipline than anything a phone settings menu can show in 2026.
