How to check an Android phone for stalkerware, safely

Stalkerware is software that someone installs on another person’s phone to watch them without their knowledge. Depending on the app, it can report location, read messages and email, see photos and videos, and record calls. The FTC’s consumer advice describes it as a tool most often used by a current or former partner. It’s built to stay hidden, so finding it means looking in the places it can’t avoid.

Signs that something may be watching

None of these prove anything on their own. Phones get slow and warm for ordinary reasons. Take them together with what the other person seems to know.

On the phone:

• the battery drains faster than it used to;
• data use goes up for no clear reason;
• the phone runs hot when you’re not using it;
• it turns off and on unexpectedly.

In the other person’s behavior:

• they know where you’ve been without being told;
• they know details of private conversations or who you’ve been texting;
• they know what you’ve looked at online;
• they’ve had your phone, unlocked, without you watching.

Safety first

Before you change anything, think about how the person might react if their access suddenly stops. The FTC advises that removing stalkerware can tip off the person who installed it, and that someone who monitors a partner may escalate if they lose access. It also suggests contacting an advocate from a different device, such as a friend’s phone or a cheap prepaid one.

An advocate can help you make a safety plan, decide what to change and when, and keep evidence before you remove anything. If evidence matters to you, see keeping evidence of harassment.

Where to look on Android

Menu names vary by phone maker. If you can’t find a setting, search for it in Settings.

1. The full app list

Open Settings, then Apps, then the option to see all apps. Go through the whole list, including system apps if your phone offers to show them. Look for:

• apps you don’t remember installing;
• generic names like “System Service”, “Sync” or “Device Health” that don’t match anything you know;
• apps with no icon on your home screen.

Look up any name you’re unsure about on another device before deciding it’s harmful.

2. Device admin apps

Search Settings for Device admin apps. These have extra control over the phone, and stalkerware often asks for it so it’s harder to remove. Normally you’d see only things like your find-my-device service or a work app.

3. Special app access

Search Settings for Special app access. Check:

• Notification access: apps that can read every notification, including message previews.
• Accessibility: under the Accessibility settings, apps that can see your screen and act for you. Stalkerware abuses this heavily.
• Install unknown apps: apps allowed to install other apps from outside the app store.
• Usage access: apps that can see which apps you use and when.

4. Permissions

The privacy dashboard shows which apps recently used your location, camera and microphone. An unfamiliar app using them is a red flag.

5. A malware scan

Open the app store app, tap your profile picture and open its built-in malware protection to run a scan. It catches some stalkerware, but not all.

6. Rooting

Some stalkerware needs the phone’s security protections removed, which is called rooting. The Safety Net Project, run by the National Network to End Domestic Violence, has guides on checking for it.

If you find something

Your choices, ideally made with an advocate:

• Leave it for now, and use a different device for anything private while you plan.
• Document it with photos of the screen from another device.
• Get a new phone with a new account the other person can’t reach. This is the safest option.
• Factory reset the phone if you must keep it. Don’t restore apps from a backup afterward; download them fresh.

Then change the passwords of your main accounts from a safe device, turn on two-step verification and check which devices are signed in.

Keeping it off

• Use a screen lock only you know, of six digits or more, and change it if someone has seen it.
• Don’t leave your phone unlocked with anyone you don’t fully trust.
• Keep the phone and apps updated.
• Consider Advanced Protection, which blocks apps from outside the app store and limits accessibility access to verified tools.

What a vault can and can’t do here

Stalkerware runs as part of the phone, so it can see what’s on screen and what you type. A vault app can’t defend against that. Silo, coming soon to iPhone and Android, keeps imported photos encrypted under its own PIN, which helps against someone browsing your phone. It isn’t a defense against monitoring software.