How to verify if your phone has hidden tracking software
The practical challenge of verifying whether a phone has hidden tracking software can sound alarmist, but the term covers very different risks. Covert stalkerware, employer-managed profiles, compromised accounts and advertising trackers leave different traces. A sudden battery drain is a clue, not a diagnosis, and one unfamiliar app does not prove malicious intent.
Begin by establishing what is normal on your device. Record the operating-system version, active accounts, installed apps and typical battery use. That baseline turns vague anxiety into a comparison you can test, and it prevents you from deleting harmless tools or resetting a working phone for no reason.
Australian context matters. The federal Privacy Act 1988 and Australian Privacy Principles regulate many organisations and government agencies, while states and territories maintain their own privacy rules. The Telecommunications Act 1997 governs authorised access to communications data. These safeguards do not prevent every form of monitoring, especially where someone already has physical or account access.
This guide covers consumer Android and iPhone devices, not specialist forensic analysis. It explains how to review permissions, profiles, sessions, location settings, pairing records and built-in security features, then identifies Australian sources of help. The aim is a defensible process that separates ordinary data collection from covert interference without exposing more personal information while checking.
Start with a calm, evidence-based baseline
Create the baseline on a day when the phone is behaving normally. On Android, note Settings > Apps, recent installs and battery usage; on iPhone, check Settings > Apps, Screen Time and Battery. Photograph the lists for comparison, then remove them securely after the review so the record itself does not become another sensitive document.
Look for patterns rather than isolated readings: an app using mobile data while closed, a microphone or location permission granted recently, unknown Bluetooth devices, new login activity or a profile that appeared after you tapped a link. None of these proves surveillance, but several changes appearing together justify investigation.
Make the check routine rather than a panic-driven clean-up. The point about habits of successful people is useful here: small, repeatable checks catch changes earlier than occasional bursts of suspicion. A weekly two-minute glance at accounts, permissions and paired devices is enough for most people.
Audit apps, permissions and device profiles
Sort apps by recently installed or last used, then check the store, developer and permissions for anything you do not recognise. Pay particular attention to apps installed from a browser, messaging attachment, QR code or phone repair shop. A useful test is whether you can explain what each app does and why it needs the access it requests.
Review Accessibility, notification access, device administration, VPN, screen-recording and microphone permissions. Legitimate accessibility and VPN apps exist, so suspicious behaviour and excessive privileges matter more than the label alone. On iPhone, look under Settings > General > VPN & Device Management for configuration or management profiles; on Android, check Settings > Apps > Special app access.
Phones bought second-hand through Australian marketplaces, or repaired at independent shops in Melbourne, Sydney or Brisbane, may retain accounts, eSIM profiles or monitoring software. Factory-reset a second-hand phone before use and avoid random repair offers. A Sunday planning routine can include a fifteen-minute monthly app-and-profile audit, keeping the task manageable.
Secure accounts and dismiss activation scams
Open the Google or Apple account used on the phone and review signed-in devices, recovery details, passkeys and recent security notices. Revoke sessions you cannot identify, but do this from a different, trusted device. An attacker who controls the phone can recapture a password or fake a familiar login screen.
Activation prompts deserve particular caution. McAfee is a familiar name in the Australian consumer security market, but search results presented as McAfee activation information may lead to affiliate portals, generated serial numbers or credential traps. Use the vendor’s official app or support channel, never a link from an unexpected text, email or pop-up.
After removing a suspected unauthorised app or profile, change the main email password first, then the phone account password, and enable phishing-resistant MFA where available. Sign out of unknown sessions and check for forwarding rules, app-specific passwords and new recovery contacts. This order limits the chance that a still-active session can undo the cleanup.
Inspect location, connections and physical access
Review location services app by app, including background access, precise location and “always” permission. Compare Google Location History or Find My Device with Apple’s Find My and Significant Locations; these histories can be helpful evidence, but they may also expose the phone owner’s movements if the account is compromised. Remove location access that has no legitimate purpose.
Inspect Bluetooth and connected-device lists, USB accessories, headphones and charging hardware. Stalkerware can exist as an app or, less commonly, a physical recording device, so physical security still matters. In Australian cities, the habit of connecting to café or airport Wi-Fi in Melbourne or Sydney adds ordinary network exposure; a VPN can protect traffic, but it cannot repair a compromised phone.
Check for a new SIM or eSIM, call forwarding, voicemail changes and unfamiliar mobile-plan features through Telstra, Optus or Vodafone’s official account tools. Do not expect a carrier to disclose another person’s live location without lawful authority. Australian network and communications access is governed by the Telecommunications Act 1997 and related legal instruments, which distinguish authorised access from an unauthorised tracker.
Run the phone’s built-in safety checks
Use the protections already built into the device. Update iOS or Android, then run Google Play Protect from the Play Store and review its scan, status and certification pages. On iPhone, check Privacy & Security > Security for Lockdown Mode and Security Reports, and review Find My devices. These checks can identify risky settings; they are not a substitute for careful manual review.
Be wary of viral code strings and “detector” apps. Some Android dial codes can initiate destructive actions, including a wipe, and a third-party detector may request the same access it claims to protect. Avoid granting screen, accessibility or device-admin rights merely to obtain a scan, and do not install another profile from a message.
If a known malicious app cannot be removed, contact the manufacturer or a qualified device specialist before considering a factory reset. Back up important data selectively, restore only trusted accounts, and check again after restoration. A full reset can erase evidence, so in a safety case preserve screenshots and relevant account information before making changes.
Separate ad tracking from hidden surveillance
Advertising trackers are different from covert surveillance. A browser or app can share advertising identifiers, inferred interests and browsing activity with ad-tech companies without displaying a tracking icon. The federal Privacy Act and APPs may constrain how covered organisations handle personal information, yet consent banners, privacy policies and legitimate terms can still make data collection look unobtrusive.
An independent browser ad-blocker review can help reduce exposure to third-party ads and tracking scripts in Chrome or Firefox. Blockers are useful for web advertising, but they do not detect stalkerware, reveal a malicious app or stop collection by software that already has microphone, location or full-device permissions.
Clear cookies and site data, reset advertising identifiers where available, limit cross-app tracking and use private browsing for sensitive searches. Review the Google My Activity and ad-controls pages for Google accounts, and check Safari privacy settings on iPhones. These measures reduce commercial profiling; they should complement, not replace, the app and account checks.
Escalate credible risks through Australian channels
Escalate when the evidence suggests an unauthorised person, especially if accounts were changed, intimate messages were accessed, a physical tracker was found, or you fear imminent harm. Save dates, screenshots, unfamiliar app names, device identifiers and account notices. Keep the phone available for examination rather than continuing to experiment with unfamiliar cleanup tools.
Australian resources include the eSafety Commissioner for online threats and image-based abuse, IDCARE for digital and domestic abuse, ACSC guidance for cyber incidents, OAIC for eligible data-breach matters, and Scamwatch for fraud advice. Police and 000 are appropriate where there is immediate danger or a credible criminal threat.
If the device belongs to an employer or school, ask the administrator what management profile is expected instead of removing it. If it is a personal phone and intimate or coercive monitoring is suspected, a specialist digital-support service can document the device before a reset. Support is especially important when an abuser may know every password and account you change.
A useful verification process produces evidence: a baseline, a list of changed settings, account-session records, permission decisions and a record of any physical indicators. One unusual signal can have an innocent explanation. A chain of signals, linked to an unauthorised person or a loss of control, deserves a different response from a noisy battery graph or an aggressive advertising SDK.
The lesson to remember is that a phone is a powerful personal computer, not merely a phone. Verify from the operating system inward, keep Australian legal and support options in mind, and avoid creating new exposure while trying to uncover the old. Confidence comes from a repeatable process and clear records rather than a single scanner’s verdict.