| Myth | Reality |
|---|---|
| Stalkerware is rare and only used by highly technical people. | Stalkerware apps are sold openly online, require no special skill to install, and researchers estimate hundreds of thousands of devices are affected every year. |
| If my phone is running slow or hot, that is the only sign of stalkerware. | Performance issues are one clue, but many modern stalkerware tools are optimized to hide battery and data usage, so the strongest signs are often behavioral, such as someone knowing private details they should not know. |
| I should remove stalkerware the moment I suspect it. | In an abusive-relationship context, removing stalkerware immediately can alert the abuser the instant monitoring stops, which can escalate risk. Safety planning should come first. |
| A factory reset always guarantees stalkerware is gone. | A factory reset removes most stalkerware, but restoring apps or files from a compromised backup can silently reinstall it, so the restore process needs care too. |
What Stalkerware Is and Why It Is Different From Ordinary Spyware
Stalkerware refers to commercially available apps or configuration profiles that are installed on a phone, usually by someone who has or once had physical access to the device, in order to secretly monitor calls, text messages, photos, browsing history, GPS location, microphone activity, and sometimes even camera feeds. Unlike generic spyware built by criminal groups to steal banking credentials from strangers, stalkerware is almost always installed by someone the victim knows personally: a current or former partner, a spouse, a parent, or occasionally an employer using a device that was supposed to be personal. That personal relationship is what makes stalkerware uniquely dangerous. The person operating it usually already has emotional leverage, physical proximity, and knowledge of daily routines, and the data collected can be used to control, intimidate, or locate a person who is trying to leave an unsafe situation.
Because stalkerware sits in a legal gray zone, many of these apps are marketed under euphemisms such as “parental monitoring,” “employee tracking,” or “family safety” tools, even when they are being used to secretly surveil an adult partner without consent. Some are disguised as harmless-looking utility apps, calculator apps, or system services so that a quick glance at the home screen reveals nothing unusual. This is why detection requires a methodical approach rather than a single glance at installed apps.
Read This Before You Do Anything Else: Safety Planning Comes First
If you believe stalkerware was installed by a current or former partner, or by anyone you have reason to fear, the most important step is not technical, it is safety planning. Stalkerware typically reports back to the person who installed it. The moment you uninstall the app, run a security scan that quarantines it, or perform a factory reset, that person may be notified that monitoring has stopped, or they may simply notice the sudden loss of information and become suspicious. In situations involving domestic violence or coercive control, a sudden change in monitoring status has been linked to escalation, including the point at which a victim is preparing to leave, which safety experts widely regard as the most dangerous phase of an abusive relationship.
Before touching the suspected device, consider these safety-first actions:
- Contact a domestic violence advocate or hotline that has experience with technology-facilitated abuse before making changes to the device. In the United States, the National Domestic Violence Hotline is reachable 24 hours a day at 1-800-799-7233. The Coalition Against Stalkerware also publishes country-specific support contacts.
- Assume that anything you search for or type on the suspected device could be visible to the person monitoring it. Use a different device, such as a library computer, a trusted friend’s phone, or a work computer, to research stalkerware removal and to contact support services.
- Document evidence discreetly before removing anything. Screenshots, dates, and a written timeline can matter later for legal protection orders or law enforcement reports.
- Think through where you will go and how you will communicate if the person who is monitoring you reacts badly once tracking capability is lost. A safety plan can include a packed bag, a trusted contact, and an alternate way to communicate that does not rely on the monitored device.
- If you are not in immediate danger, consider continuing to use the monitored device normally for a short period while you quietly prepare, rather than tipping off the abuser through sudden behavioral changes.
None of this is intended to delay action indefinitely. It is intended to make sure the order of operations protects your physical safety before it protects your digital privacy.
Recognizing the Signs of Stalkerware on a Phone
Stalkerware is designed to be invisible, but almost no monitoring app is perfect. The clues tend to fall into two categories: technical symptoms on the device itself, and behavioral clues from the person you suspect is monitoring you.
Technical Warning Signs
- Battery drains noticeably faster than usual, even with normal use, because monitoring apps continuously collect and transmit data in the background.
- The phone feels warm or the fan-equivalent processes spike when the device is sitting idle and not actively being used.
- Mobile data usage climbs even though your own browsing and app habits have not changed.
- The phone takes longer to shut down or restart than it used to, because a hidden process is trying to keep running.
- Unusual pop-ups, security warnings, or a suddenly disabled antivirus or security app appear without explanation.
- On Android, an unfamiliar app appears in the list of device administrators or accessibility services, or “install from unknown sources” has been enabled without your knowledge.
- On iPhone, an unfamiliar configuration profile appears under Settings, or a device you do not recognize is listed as trusted under your Apple ID’s connected devices.
Behavioral Warning Signs
- Someone repeatedly seems to know where you have been, who you spoke with, or what you said in a private conversation, without a reasonable explanation for how they found out.
- A partner insists on knowing your phone passcode, wants unsupervised access to your device “to fix something,” or reacts with unusual anger if you decline.
- You notice the phone was out of your possession for an unexplained period, even briefly, which is often enough time to install stalkerware.
- You receive account login alerts, password reset emails, or two-factor authentication prompts you did not request.
How Stalkerware Typically Reaches a Phone
In most documented cases, stalkerware is installed manually by someone with brief physical access to an unlocked device, rather than through a remote hack. The installer typically needs only a few minutes: unlocking the phone, downloading the app or profile from a direct link (bypassing the official app store), granting permissions, and hiding the icon. This is why protecting the lock screen passcode and noticing unexplained gaps in phone possession matters as much as any software scan.
Safe Detection Steps That Do Not Tip Off an Abuser
If you have decided, ideally after consulting a domestic violence advocate, that it is safe to check your device, proceed carefully and avoid actions that would visibly change settings the monitoring person might notice, such as suddenly installing a security app they do not recognize.
| Platform | Where to check | What to look for |
|---|---|---|
| Android | Settings, then Apps, then see all apps (including system apps) | Unfamiliar app names, apps with generic icons like a gear or calculator that do not match their listed function |
| Android | Settings, then Security, then Device admin apps | Any app with device administrator privileges you did not grant yourself |
| Android | Settings, then Accessibility | Unknown services with accessibility permissions, which stalkerware often abuses to read screen content |
| iPhone | Settings, then General, then VPN and Device Management | Any configuration profile you did not install |
| iPhone | Settings, then your Apple ID name, then scroll to devices | Devices you do not recognize with access to your Apple ID |
| iPhone | Settings, then Screen Time | Screen Time enabled with a passcode you did not set, which can indicate remote monitoring configuration |
| Both | Battery usage statistics | An app consuming significant battery in the background that you do not recognize or rarely use |
A reputable mobile security app can also help. Tools such as Certo, which partners with the Coalition Against Stalkerware, scan for known stalkerware signatures on both iPhone and Android, and can review an iPhone’s backup file for spyware traces without requiring you to jailbreak the device. Mainstream antivirus vendors, including Bitdefender, Norton, and Kaspersky, also include stalkerware detection modules, though custom or very recently updated stalkerware sometimes evades signature-based scanning. If a scan comes back clean but behavioral signs persist, it does not necessarily mean you are wrong, it may mean the specific tool used is not yet detected by that scanner.
How to Remove Stalkerware Safely
Once you have completed safety planning and decided the timing is right, removal generally follows this order.
- Back up what you need for evidence first. Before wiping anything, photograph or screenshot suspicious apps, permissions, and configuration profiles in case you need them for a police report or protective order.
- Change passwords from a different, secure device. Update your email, banking, social media, and cloud account passwords from a computer or phone the monitoring person cannot access, and enable two-factor authentication using an authenticator app rather than SMS where possible.
- Remove the identified stalkerware app or profile. On Android, uninstall the app after first revoking its device administrator and accessibility permissions. On iPhone, delete the unfamiliar configuration profile and remove any unrecognized trusted device from your Apple ID.
- Perform a factory reset for full confidence. A factory reset is the most reliable way to remove stalkerware, particularly variants that hide as system processes. Set the device up as new rather than restoring from a recent backup, since restoring app data can silently reintroduce the same stalkerware.
- Create new accounts where compromise is suspected. If you believe your Google account or Apple ID itself was compromised, consider creating a new account rather than reusing the old one, and update recovery email addresses and phone numbers.
- Update the operating system fully. Many stalkerware variants exploit older software versions or rely on accessibility loopholes patched in newer releases, so a full update after the reset closes reinstallation paths.
Common mistake
Removing the suspicious app the moment it is found, without any safety plan, is the most common and most dangerous mistake in stalkerware cases involving an abusive partner. Sudden loss of monitoring access can prompt confrontation at exactly the moment a victim is most vulnerable. Always loop in a domestic violence advocate or trusted safety resource before changing anything on a device you suspect is being monitored by someone who could become violent.
What worked
Advocates who work with technology-facilitated abuse survivors consistently report that combining a professional factory reset with a full account credential rotation from a separate, secure device is more effective than app-by-app removal. Setting the phone up as new, rather than restoring from a backup, prevents stalkerware from silently reappearing, and rotating credentials closes any account-level access the abuser may have obtained independently of the phone itself.
| Removal method | Effectiveness | Best used when |
|---|---|---|
| Uninstall the identified app manually | Moderate, may miss hidden components | You are confident you found the only monitoring app and need a fast, low-visibility fix |
| Anti-stalkerware scanning app (for example Certo) | High for known signatures | You want confirmation before deciding whether a full reset is necessary |
| Full factory reset plus setup as new | Very high | You have completed safety planning and want the strongest guarantee of removal |
| Replace the device entirely | Highest | The device is old, was purchased or given by the monitoring person, or hardware-level compromise is suspected |
Protecting Yourself Going Forward
After removal, a few ongoing habits significantly reduce the chance of re-infection. Keep your phone locked with a strong passcode rather than a pattern or short PIN, and avoid sharing that passcode even with people you trust, since stalkerware installation almost always requires a few unsupervised minutes with an unlocked device. Review app permissions periodically, particularly accessibility and device administrator access on Android and configuration profiles on iPhone. Enable Find My Device or Find My iPhone features under your own control, and check periodically that no unfamiliar device is listed on your account. If you share a family plan, a shared streaming subscription, or a family password manager with a partner, review who has administrative visibility into your individual account activity, since some monitoring is not installed on the device itself but authorized instead at the account or carrier level.
If you are supporting a friend or family member through this situation rather than experiencing it yourself, the most useful thing you can offer is patience and a safe device to research from, rather than pressure to act immediately. Recovery from technology-facilitated abuse is rarely a single afternoon of technical cleanup, it is a process that unfolds alongside broader safety planning.
- Configuration profilesOften overlooked on iPhone because they live outside the normal app list, yet they can grant remote monitoring access without an app icon ever appearing.
- Accessibility service abuseAndroid accessibility permissions, meant to help users with disabilities, are frequently hijacked by stalkerware to read on-screen text such as messages and passwords.
- SIM swap riskEven after removing stalkerware from the phone, an abuser with access to personal details can sometimes convince a carrier to transfer your number to a new SIM, restoring some access.
- Shared cloud backupsRestoring a “clean” new phone from an old cloud backup can silently reintroduce stalkerware if the backup itself was taken while the app was installed.
- Family locator featuresLegitimate family location-sharing features can be repurposed for covert monitoring, and are worth auditing even if no stalkerware app is found.
- Old device handoffsA phone handed down from a former partner or family member should always be factory reset and fully updated before regular use, even if it appears clean.
- Legal evidence gapsScreenshots taken after removal cannot prove what was on the device, which is why documenting evidence before wiping anything matters for any future legal action.
Glossary
- Stalkerware
- Commercially sold monitoring software installed on a device, typically by someone with a personal relationship to the victim, used to secretly track communications, location, and activity.
- Configuration profile
- A settings file on iPhone that can grant an installer remote management capabilities over the device, sometimes used to enable covert monitoring.
- Device administrator access
- An elevated Android permission level that gives an app significant control over the device, including the ability to resist normal uninstallation.
- Accessibility service
- An Android feature designed to assist users with disabilities that can be abused by malicious apps to read screen content and simulate taps.
- Technology-facilitated abuse
- The use of digital tools, including stalkerware, location sharing, and account monitoring, as part of a pattern of coercive control in an abusive relationship.
- Coalition Against Stalkerware
- An international group of cybersecurity companies, nonprofits, and researchers working together to combat non-consensual monitoring software and support survivors.
Key Takeaways
- Stalkerware is almost always installed by someone the victim knows, using brief physical access to an unlocked phone.
- Safety planning must come before removal whenever an abusive partner or ex-partner is suspected, since sudden loss of monitoring can escalate risk.
- Battery drain, unexplained data use, and a phone running warm while idle are common technical signs, but behavioral clues often surface first.
- Check device administrator and accessibility permissions on Android, and configuration profiles and trusted devices on iPhone.
- Reputable scanning tools like Certo can confirm suspicions, but a clean scan does not always rule out very new or custom stalkerware.
- A factory reset with setup as new, rather than restoring from a backup, gives the strongest guarantee of full removal.
- Rotating account passwords and enabling authenticator-based two-factor authentication from a separate secure device closes access the abuser may hold beyond the phone itself.
FAQs
What is the fastest way to check if stalkerware is on my phone?
Review installed apps, device administrator settings, and accessibility permissions on Android, or configuration profiles and trusted Apple ID devices on iPhone. Pair this with a reputable scanning app such as Certo for a second opinion, since some stalkerware hides from a manual review alone.
Should I remove stalkerware immediately once I find it?
Not necessarily. If an abusive partner or ex-partner may be responsible, contact a domestic violence advocate or hotline first to build a safety plan, because removing monitoring suddenly can alert the abuser and increase risk during an already dangerous period.
Will a factory reset definitely remove stalkerware?
A factory reset removes the vast majority of stalkerware, especially when you set the phone up as new rather than restoring from a recent backup. Restoring app data from a compromised backup can silently reinstall the same monitoring software.
Can stalkerware be installed without touching my phone?
Most consumer stalkerware requires a few minutes of physical access to an unlocked device to install. Remote installation without any physical access is rare for commercial stalkerware, though account-level monitoring through shared logins or family location features does not require touching the device.
Does a factory-default antivirus app catch all stalkerware?
No single scanner catches every variant. Mainstream tools like Bitdefender, Norton, and Kaspersky detect many known signatures, and specialized tools such as Certo focus specifically on stalkerware, but newly modified or custom builds can still slip through, so behavioral evidence still matters.
What should I do before wiping a phone I suspect has stalkerware?
Screenshot or photograph the suspicious apps, permissions, and any unfamiliar profiles for potential use in a police report or protective order, and change your important account passwords from a separate, secure device before you reset the phone.
Is it illegal for someone to install stalkerware on my phone?
In most jurisdictions, installing monitoring software on another adult’s device without consent is illegal under wiretapping, computer misuse, or stalking laws, even if the app itself is marketed for legal purposes such as parental monitoring or employee tracking.
How can I get help if I think I am being monitored by an abusive partner?
Contact a domestic violence hotline such as the National Domestic Violence Hotline at 1-800-799-7233, or the Coalition Against Stalkerware for technical guidance, using a device the suspected abuser cannot access, such as a friend’s phone or a library computer.
References
- Coalition Against Stalkerware, stopstalkerware.org
- Tech Safety Canada, Phone Stalkerware and Safety Guide, techsafety.ca
- Safety Net Project, Spyware and Stalkerware: Phone Surveillance, techsafety.org
- Certo Software, iPhone and Android Spyware Detection, certosoftware.com
- SafetyDetectives, What Is Stalkerware, How to Detect and Remove It, safetydetectives.com
- National Domestic Violence Hotline, thehotline.org
If you also manage shared subscriptions or devices with family members, see our guide on securing shared family accounts against unauthorized access. For a broader look at social engineering tactics that often accompany technology-facilitated abuse, read about recognizing manipulative scam patterns. Before wiping a device, it helps to understand how to back up evidence and personal data safely. It is also worth reviewing common cybersecurity myths that create false confidence, and checking the security posture of any personal AI assistants and connected accounts that might also expose your location or habits.
