How can I tell if my phone has been hacked?

A hacked phone rarely gives itself away through its battery or its speed. The real signs are more concrete: an unknown app with powerful rights, a management profile you did not install, an unknown device linked to your account, or someone close to you who knows things they should not know.

Which signs should really worry you?

→An app you do not recognise, especially if it has the “Accessibility” right, which lets it see everything on your screen and tap for you, or device administrator rights.
→On Android, an installed app with no icon on the home screen.
→On iPhone, a management profile you did not install, or features turned off for no reason: camera, App Store, Face ID.
→An unknown device linked to your Google account, your Apple account or your messaging app.
→A keyboard you did not choose: a keyboard sees everything you type.
→Someone close to you who knows your messages or where you have been. If this keeps happening, it matters more than any other sign.

Which signs prove nothing on their own?

A battery that gets hot, a slow phone, data use that changes: these signs almost always have an ordinary cause (a badly made app, an ageing battery, an update). Trasimène still measures them, as clues:

→on Android, it reads the battery temperature and only worries above 45 °C;
→on Android and iPhone, it compares what the phone sends with what it receives, because unusually high sending can reveal a data leak.

What does Trasimène check on Android?

As of October 2026, at every scan (every 30 minutes by default), Trasimène looks at, among other things:

→whether an installed app is on its list of known surveillance and remote-control tools, kept up to date by its servers;
→which apps have accessibility, administrator rights or read your notifications, and where they come from;
→apps with no icon and unknown keyboards;
→apps that combine the microphone, or the camera, with internet access;
→apps that can record your screen on top of accessibility;
→security certificates added to the phone, a network proxy, an intercepted connection;
→signs of deep tampering (root) and of the Frida spying tool;
→a changed SIM card;
→notifications from your messaging apps saying a new device has just been linked to your account.

Some of these checks need a permission (notification access, app usage access): without it, they stay grey.

What does Trasimène check on iPhone?

iOS does not let any app see the list of other apps. So Trasimène checks other things:

→signs of jailbreak;
→whether the iPhone is managed or restricted: management profile or server, features turned off;
→tools that install apps outside the App Store, and some known dangerous apps, when iOS lets it spot them;
→where your active keyboards come from;
→interception of secure connections and a network proxy;
→developer mode turned on;
→an outdated iOS version.

What can Trasimène not see?

→Someone with access to your Apple or Google account can see your backups, photos or location without installing anything on the phone. You check this in your account settings, not with a scan.
→On iPhone, Trasimène cannot see other apps or their files.
→No app sees everything: Trasimène does not promise 100% protection.

What should you do if you think you are being spied on?

If the person is someone close to you, do not delete the suspicious app right away: removing it can alert the person who installed it, and it also deletes evidence. First write down what you see (screenshots, dates), and get help: stopstalkerware.org lists support organisations country by country.

The steps below are explained in our article on the most likely spy on your phone. In this order:

→Change your unlock code.
→From another device you trust, change your email password, then your Google or Apple account password.
→Remove any device you do not recognise from these accounts.
→Turn on two-factor authentication.
→As a last resort, reset the phone, without restoring a doubtful backup.

Check it yourself in five minutes

→Android: Settings, Accessibility, to see which services are on; then the list of device admin apps (often in Settings, Security; the path depends on the brand).
→iPhone: Settings, General, VPN & Device Management. If a profile is listed and neither you nor your employer installed it, take it seriously.
→Your accounts: the list of devices signed in to your Google account and your Apple account.

For an ordinary person, the most likely spy is not a faraway hacker, but someone who had the phone in their hands. The useful signs are concrete and take a few minutes to check. Trasimène checks some of them for you, regularly; the rest happens in your account settings.

Sources

Trasimène: Mobile security

Check your phone for free

Download Trasimène →