Signs that something is watching
None of these prove anything on their own. Phones get slow and batteries age. But several together, plus a person who seems to know things they should not, are a reason to check.
Someone knows where you have been, what you wrote or who you called. Your battery drains much faster than it used to. The phone is warm when you are not using it. Data usage went up without a new habit. Settings you did not change are on, especially 'Install unknown apps', accessibility services or a device admin app you do not recognise. There is an app you do not remember installing, sometimes with a plain name like 'System Service' or 'Sync'. Someone had your phone and your unlock code, even for a few minutes.
Where stalkerware hides
Most stalkerware for Android is not on Google Play. It is sideloaded: downloaded as a file and installed with 'Install unknown apps' allowed. To keep working it usually asks for powerful access: device administrator rights so it is hard to uninstall, accessibility service access so it can read what is on the screen, notification access so it can read messages, plus location, microphone, camera, SMS and call log permissions. It often hides its icon from the app drawer, but it still appears in Settings.
That is the weakness you can use. Android lists every installed app, every device admin app and every accessibility service in Settings, whether the icon is hidden or not.
Manual checks in Settings
Paths differ slightly between phones. Use the search box at the top of Settings if you cannot find a screen. Do not uninstall anything yet; take notes or photos of what you find with another device.
- 1
Device admin apps
Settings, Security, Device admin apps (sometimes under 'More security settings'). Normal entries are Find Hub, a work profile or a corporate management app. Anything else you did not knowingly set up needs a closer look. Alert24 appears here if you turned on its Intruder Alert; that is expected.
- 2
Accessibility services
Settings, Accessibility, then look for downloaded or installed services. Screen readers and tools you chose are fine. An unknown service with accessibility access can read everything on your screen.
- 3
Notification access and other special access
Settings, Apps, Special app access. Check Notification access, Display over other apps, Usage access and Install unknown apps. Note which apps have each one.
- 4
The full app list
Settings, Apps, See all apps, and turn on 'Show system' from the menu. Read the whole list slowly. Look for names that sound generic, apps with no icon, or apps installed around the time your suspicion started. Tap one to see its permissions and when it was installed.
- 5
Battery and data usage
Settings, Battery, Battery usage and Settings, Network, App data usage. An app you never open near the top of either list is worth checking.
- 6
Google Play Protect
Open Google Play, tap your profile picture, Play Protect, Scan. Play Protect flags many known stalkerware apps. Make sure it is turned on; some stalkerware asks the installer to turn it off.
- 7
Your accounts
At myaccount.google.com, check Security, Your devices, and sign out any device you do not recognise. Do the same for messaging apps that allow linked devices. Monitoring does not always need an app on the phone; a linked web session is enough.
Alert24's suspicious-apps scan
Alert24 includes a Suspicious Apps check on its home screen. It looks for apps that were not installed from an app store, are not part of the system, hold device administrator rights, and request a large share of Android's most sensitive permissions such as camera, microphone, location, SMS and call logs. That combination is typical of stalkerware, and the scan lists such apps and opens their App info page so you can review them. Results are part of Alert24 Premium.
Be clear about what it is not. It is not an antivirus and does not compare apps against a list of known malware. An app that avoids device admin rights, or that came from an app store, will not be flagged. A clean result is not proof that your phone is clean. Use the scan as one more place to look, together with the manual checks above and Google Play Protect.
- Flags sideloaded apps with device admin plus many risky permissions
- Opens App info so you can check permissions and uninstall
- Not a malware scanner and not a guarantee
Removing it safely
Only start here once you have thought about your safety and, if you may need evidence, documented what you found.
- 1
Decide whether you need evidence first
If you may report this to the police or use it in a legal process, photograph the app details, permissions and install date with another device, or ask a support organisation how to preserve evidence before removing anything.
- 2
Remove device admin rights
In Device admin apps, deactivate the suspicious app. Android does not let you uninstall an active device admin app, so this comes first.
- 3
Turn off its accessibility and special access
Switch off the app's accessibility service and notification access, then uninstall it from Settings, Apps.
- 4
When in doubt, factory reset
A factory reset removes apps that hide well. Back up photos and contacts first, then Settings, System, Reset. Afterwards set up the phone as new, not from the old backup, and use a new screen lock code.
- 5
Change codes and passwords
Change your screen lock and your Google, email and messaging passwords from a device you trust, and turn on two-step verification. Remove any linked devices or sessions you do not recognise.
- 6
Close the door
Turn off 'Install unknown apps' for browsers and file managers, keep Play Protect on, and do not share your unlock code. Consider Alert24's Phone Access Snap, which photographs whoever unlocks your phone so you know if someone used it while you were away.
Frequently asked questions
Can someone install stalkerware without touching my phone?
For most Android stalkerware, no. It needs physical access and your unlock code for a few minutes. Account-based monitoring, such as a linked messaging session or a shared Google account, is possible without touching the phone, so check accounts too.
Will the person be notified when I remove it?
Some stalkerware tells the installer when it stops reporting. Treat removal as something they may notice and plan for that before you act.
Does Alert24 detect stalkerware?
The suspicious-apps scan lists sideloaded device admin apps with many risky permissions, which describes a lot of stalkerware, but not all of it. It is not antivirus and does not guarantee detection. See the feature page.
Is a factory reset enough?
It removes apps on the phone. It does not remove someone's access to your accounts, and it does not help if you restore a backup that includes the app. Reset, set up as new, then change passwords.
Know when someone used your phone
Alert24 photographs whoever tries to unlock your phone and lists sideloaded apps with suspicious access. It is one more check, not a replacement for care with your unlock code.