Every list of warning signs you will find on this subject starts with the same four items: the battery, the heat, the data, the slowness. All four are real symptoms of phone surveillance. All four are also what a two-year-old battery, a system update and a photo library syncing after a holiday look like.

That is a problem, because it means the most widely repeated advice on the internet cannot distinguish between a compromised phone and a normal ageing one. If you are here because something made you uneasy, being told to watch your battery is not much help.

So this guide splits the signs into two groups: the ones that genuinely carry weight, and the ones almost everybody leads with that you should largely discount on their own.

The signs that actually carry weight

Each of these is hard to explain away. Any one of them deserves a proper look.

An app with permissions that only surveillance needs

On Android, open Settings and check three screens: Accessibility (downloaded services), notification access under special app access, and device admin apps under Security. Commercial monitoring software needs these, because they are how it reads your screen, your notifications and your keystrokes. On a normal personal phone the first and third are usually empty.

On iPhone, the equivalent is Settings, General, VPN and Device Management. A configuration profile is a legitimate tool for employers and schools, and one of the few supported ways to get persistent monitoring onto an iPhone without exploiting it. On a personal phone it should be empty.

Names in these lists are deliberately boring: System Service, Device Health, Update Manager, Sync Services. A real system component does not appear in the downloaded section.

A device you do not recognise on your account

Check your Apple ID device list (Settings, then your name) or your Google account at myaccount.google.com. Somebody signed in to your account does not need software on your phone at all. They can read your backups, your messages and your location from their own device.

This is the most overlooked route in every guide, and one of the most common in practice.

Play Protect switched off when you did not switch it off

On Android, Play Store, profile icon, Play Protect. It is on by default and warns you about apps installed from outside the store. Finding it disabled is not a symptom; it is evidence of a decision somebody made.

An Apple threat notification

Apple warns users it believes were targeted by mercenary spyware. Sign in at account.apple.com and look for a banner.

One caveat that matters: because these warnings are frightening and well known, they are a favourite disguise for scams. A genuine Apple notification never asks you to click a link, install anything or hand over a password. Check by typing account.apple.com yourself.

Jailbreak or root artefacts

Search the phone for Cydia, Sileo or Zebra on iPhone, or for a root manager on Android. Their presence is not proof that you are being watched, but it is proof that somebody removed the operating system's protections, and after that the phone is no longer a reliable witness about itself.

The other person knowing things they should not

Not technical, and often the strongest signal of all. If someone consistently knows your location, your plans, or the contents of a private conversation, and there is no ordinary way they could, that is worth more than any battery reading.

The signs everybody leads with, and what they are worth

None of these are worthless. All of them are worth far less on their own than the internet implies, because each has a mundane explanation that is more likely than surveillance.

Battery draining faster. Lithium-ion batteries lose capacity with every charge cycle. After about two years, a noticeably worse battery is the expected outcome, not a symptom. Worth noticing only if it changed abruptly, on a newish phone, with no update in between.

The phone getting warm when idle. Background app refresh, cloud backup, an indexing job after an update. Modern phones do plenty while you are not looking.

Higher data usage. Check which app. If it is your photo service or a streaming app that switched off Wi-Fi-only, you have your answer. Monitoring software does upload data, but it is usually not the largest number in that list.

The phone feeling slow, or restarting. An operating system update on older hardware produces this reliably.

Pop-up ads everywhere. Real symptom, but of adware from a dodgy app, not of targeted surveillance. Stalkerware is built to stay invisible; showing you ads would defeat its purpose.

Strange texts sent from your phone. Usually either a spoofed sender, where nothing is wrong with your phone at all, or an SMS-fraud app. Rarely monitoring.

Odd sounds during calls. This one is almost entirely folklore at this point, left over from analogue telephony. Digital call quality varies for a hundred reasons.

The honest summary: if all you have is a worse battery and a warm phone, the most likely explanation is a phone that is a couple of years old. Look at the first list instead.

What you can check yourself in ten minutes

The three permission screens on Android, or VPN and Device Management on iPhone.
Your account's device list, on both Apple and Google.
Play Protect on Android, including whether it was disabled.
Your full app list with system apps shown, looking for duplicates of ordinary tools and names you cannot place. An app can hide its icon, so scrolling the home screen proves nothing.
App permissions for location, microphone, camera and photos, looking for ordinary apps with extraordinary access.
Battery and data, read as supporting detail rather than as a verdict.

Platform-specific walkthroughs: detecting spyware on iPhone and detecting spyware on Android.

Why the checks above can only take you so far

There is a structural limit to everything you can do from the phone itself.

On iPhone, the sandbox means no App Store app can scan the system. That is why iPhone virus scanners cannot do what their listings suggest: they are checking your Wi-Fi and warning you about bad websites. On Android you can see more, but one app still cannot read another app's private data, and anything with root access can hide from the very screens listed above.

Underneath both is the same problem. A compromised phone is being asked to report on itself, using software the intruder may control.

Getting past that means analysing the phone from outside it. Connect it to a computer by cable and the device produces a backup and diagnostic data that no on-device app is permitted to read: crash logs, records of which processes used the network and when, artefacts left behind by known spyware. That material can be compared against published indicators of compromise.

This is how the researchers who actually catch these campaigns work. Amnesty International's Security Lab publishes the open-source Mobile Verification Toolkit that does exactly this, and it underpinned the Pegasus Project investigation. It is free, well regarded, and a command-line tool that assumes you are comfortable with Python and forensic output.

That gap is what Haris Shield exists to close: the same external, backup-based analysis, with a report you can read without a terminal. Scanning is free; the detailed report is the paid part.

If you find something, the order matters

The most important section here, and the one most guides skip entirely.

If the person you suspect is a partner, an ex, a family member or an employer, do not delete anything yet. Many monitoring products alert whoever installed them the moment they stop working. In a controlling situation, that alert tells the other person you found it, at a moment of their choosing rather than yours. The Coalition Against Stalkerware, which brings together domestic violence organisations and security companies, warns about this directly, and notes that deleting the software also destroys evidence you may need later.

A safer sequence:

Change nothing on the phone, and do not confront anyone.
Get advice first, from a device the other person has never had access to.
Document what you found.
Secure your accounts from a different device: email first, then Apple or Google, then messaging and banking, checking each account's recovery address and signed-in devices.
Decide about removal last, with support in place.

Our full guide to this situation is stalkerware: the signs, and what not to do.

If nobody in your life is a plausible source, the calculus is simpler: update the operating system, remove what you found, change your passwords from another device, and consider a factory reset without restoring a backup that may reinstall the problem.

Reducing the risk afterwards

A passcode nobody else knows, and no extra fingerprints or face entries you did not add. Physical access is how most of this starts.
Updates the day they arrive. Most real intrusions rely on flaws already patched.
Two-factor authentication on email first, because email resets everything else.
Do not jailbreak or root, and do not let anyone do it for you.
Review your account devices every few months.
Revisit family sharing. Location sharing set up once in a happier period, then forgotten, explains a great deal of what people experience as being tracked.

The short answer

Ignore the battery-and-heat checklists. The signs worth acting on are an app holding accessibility, notification or device-admin permissions you did not grant; a configuration profile on an iPhone you cannot explain; an unfamiliar device on your Apple or Google account; Play Protect switched off; an Apple threat notification; jailbreak artefacts; and somebody knowing things they have no ordinary way to know.

You can check all of that yourself in about ten minutes. What you cannot do from the phone is verify the phone, and if you find something and somebody in your life may be behind it, get advice before you touch a setting.

Sources

Apple, About Apple threat notifications and protecting against mercenary spyware: support.apple.com/en-us/102174
Amnesty International Security Lab, Mobile Verification Toolkit: mvt.re
Coalition Against Stalkerware, Information for survivors: stopstalkerware.org/information-for-survivors
Google, Play Protect: support.google.com/googleplay/answer/2812853
Electronic Frontier Foundation, Surveillance Self-Defense: ssd.eff.org
National Domestic Violence Hotline (US): 1-800-799-7233. Coalition Against Stalkerware lists organisations in other countries.

How to Tell If Your Phone Is Hacked: The Signs That Matter, and the Ones That Do Not