Someone Is Spying on My Phone: What to Do Right Now

Suspecting you're being watched is one of the more disorienting feelings in personal security, and it produces two common mistakes: doing nothing out of uncertainty, or immediately resetting the phone and destroying the evidence of what was actually happening. Neither serves you. What follows is the order that does.

First, separate the real signals from anxiety

Genuine surveillance tends to leave more than one trace. Before acting, look for a pattern across several of the following, not just one:

• Someone consistently knows where you were, what you said privately, or plans you only discussed by phone or message.
• Your phone's battery, data or performance changed noticeably around a specific event — a dispute, a separation, a contentious deal.
• You find an app, profile, or device permission you're certain you didn't authorise.
• A person close to you had physical access to your unlocked phone, even briefly.

If none of this applies and the concern is a general unease, our companion piece on how to know if your phone is hacked covers the broader diagnostic checklist. If it does apply — particularly the physical-access or known-adversary scenario — treat it as credible and move deliberately.

What to do, in order

1. Don't reset the phone yet. A reset destroys the evidence a forensic review would need to identify who and how.
2. Move sensitive conversations off the suspect device immediately, using a separate phone or computer you're confident is clean.
3. Check for known consumer stalkerware indicators — unfamiliar apps, unknown device administrators (Android) or configuration profiles (iOS), and battery/data anomalies.
4. Change passwords on your most sensitive accounts from that separate, clean device — email first, since it unlocks nearly everything else.
5. Enable two-factor authentication everywhere it's available, via an authenticator app rather than SMS.
6. If the case involves a known adversary, a legal dispute, or a public profile, get a professional forensic check rather than relying on consumer tools, which are not built to detect commercial-grade surveillance.

A note on shared devices and family plans

Shared family phone plans, shared cloud storage, and hand-me-down devices all create legitimate access paths that can look identical to unauthorised surveillance from the outside, which is part of what makes these situations genuinely confusing to untangle. Before assuming the worst, map out who has legitimate access to what — old Apple ID or Google account logins on a device you later gave to a family member, a cloud backup still syncing to a device you no longer use — since a meaningful share of these cases resolve once the mundane explanations are ruled out first.

Consumer stalkerware vs. targeted surveillance

These are genuinely different problems. Consumer stalkerware — installed by an ex-partner, a family member or someone with physical access — is comparatively detectable and removable with the steps above. Commercial-grade surveillance tools, sold to states and, occasionally, to well-resourced private actors, are engineered specifically to evade the checks a phone's owner would normally run, and in some configurations to survive a factory reset. If your concern involves a business dispute, litigation, a public or political profile, or a credible personal threat, assume the second category until a forensic review proves otherwise.

The wrong move is either panic or denial. The right one is a calm, evidence-preserving check.

Real surveillance is rarely limited to a phone. It frequently coincides with attempts against email, cloud accounts and even voice or video impersonation designed to extract information from people around you — the exact scenario addressed in deepfake and impersonation protection for executives. Treating the phone in isolation misses the broader pattern a determined adversary is usually running.

Protecting the people around you, not just yourself

If you're a genuine target — because of wealth, a public profile, a business dispute, or a personal situation — surveillance rarely stops at your own device. Assistants, family members, drivers and household staff are frequently easier to reach than the principal and can provide the same information indirectly: your schedule, your location, your private conversations relayed secondhand. A thorough response considers who else in your circle might be a softer target for the same information, and extends the same basic checks to them.

This is also where the emotional dimension deserves acknowledgment. Suspected surveillance is genuinely stressful, and that stress itself can be exploited — some campaigns are designed less to gather information than to make the target feel watched, unsettled and less able to think clearly. Recognising that as a tactic, rather than only as a symptom, is part of responding to it correctly.

Documentation matters more than most people realise

If there is any chance the situation becomes a legal matter — a custody dispute, a business conflict, harassment — keep a simple, dated log of what you observed and when, before you change or reset anything. This costs almost nothing to do and can matter considerably later, whereas evidence destroyed by an early reset cannot be recovered.

Obsidian Helm conducts discreet forensic device reviews for principals with genuine reason for concern, alongside the standing monitoring and response of our Personal Cybersecurity practice — delivered remotely, under NDA, with findings from one named analyst rather than an automated report.

Frequently asked