Free Checklist · No Signup Required
How to Detect Stalkerware on iPhone and Android
A calm, step-by-step checklist from the digital forensics team at Petronella Technology Group. Print it, or read it on a device the person you suspect has never touched. Everything below is conservative, well-established guidance that will not wreck a future police report or court case.
What Stalkerware Is, in One Paragraph
Stalkerware is commercial monitoring software installed on your phone, usually by someone who had physical access to it or knows your account passwords. Depending on the product, it can report your location, read messages, record calls, and watch app activity. It hides: there is rarely an icon on the home screen. Most stalkerware on phones requires that physical access or your credentials, which is why it appears most often in domestic situations, and why the person who installed it is usually someone close to you.
Warning Signs Worth Taking Seriously
No single sign proves anything. Phones drain batteries and act strangely for innocent reasons. What matters is a pattern, especially paired with the strongest signal of all: someone consistently knows things they should not know - where you were, who you talked to, what you said in private messages.
- Battery and heat: noticeably faster battery drain than before, or a phone that runs warm while sitting idle.
- Data use: a jump in mobile data consumption you cannot explain (monitoring software uploads what it collects).
- Behavior: the phone lights up or restarts on its own, is slow to shut down, or you hear odd noises on calls.
- Accounts: alerts about logins from unfamiliar places or devices, password-reset emails you did not request, security settings that changed themselves.
- History: the other person had your phone alone "to fix something," gave it to you as a gift, or set it up for you.
iPhone Check, Step by Step
Work through these in order. You are looking, not deleting - see the "what not to do" section before you remove anything.
- Run Apple's Safety Check. Open Settings, then Privacy & Security, then Safety Check. It shows what you are sharing and with whom, and can review access without notifying anyone. Use the "Manage Sharing & Access" review mode to see everything before changing anything.
- Check location sharing. In Settings under your name, look at Find My and see which people and devices can see your location. Also check the Find My app's "People" tab.
- Look for unknown configuration profiles. Settings, then General, then VPN & Device Management. A profile you did not install, especially one you cannot explain from work or school, deserves scrutiny. Photograph it before touching it.
- Review devices on your Apple ID. Settings, tap your name, scroll down: every device listed can potentially see synced data. Anything you do not recognize is significant.
- Check who has access to your Apple account. Family Sharing members, and any recovery contacts or legacy contacts you did not add yourself.
- Audit app permissions. Settings, Privacy & Security, then Location Services and Microphone: look for apps you do not recognize with "Always" location access.
Because iPhones restrict background apps, stalking on Apple devices very often happens through the account rather than an app: a shared Apple ID, a synced backup, or Family Sharing. Treat "who can see my iCloud data" as seriously as "what is installed."
Android Check, Step by Step
- Run Google Play Protect. Open the Play Store, tap your profile icon, then Play Protect, then Scan. Play Protect flags many known stalkerware apps. Note anything it reports; do not uninstall yet.
- Review accessibility services. Settings, then Accessibility. Stalkerware often abuses accessibility permissions to read the screen and keystrokes. Any app listed here that you did not deliberately enable is a red flag.
- Review device admin apps. Search Settings for "device admin" (usually under Security). Device admin rights let an app resist removal. Unknown entries here matter.
- Check the full app list. Settings, then Apps, then "See all apps," including system apps. Look for generic names like "System Service," "Device Health," or "WiFi Update" that you cannot account for.
- Check permissions managers. Settings, Privacy, Permission Manager: which apps hold Location, SMS, Microphone, and Camera access? Anything unfamiliar with broad access deserves a photo and a note.
- Check your Google account. At myaccount.google.com from a safe device, review Security, then "Your devices" and recent security events, and check whether location sharing is on in Google Maps.
What NOT to Do
Do not tip off the person monitoring you. If stalkerware is present, the installer may be alerted when it stops reporting. Sudden silence from the app can escalate a dangerous situation and destroys your chance to document it. Plan before you act, ideally with a domestic violence advocate or law enforcement if physical safety is a concern.
Do not factory-reset the phone yet. A reset likely removes the software, but it also removes the evidence. If you may ever want a police report, a protective order, or a civil case, the phone in its current state is your proof. Preserve first, clean second.
- Do not confront the suspected person with what you found until you have a safety plan and copies of the evidence.
- Do not delete suspicious apps or profiles before photographing them and noting dates.
- Do not change every password from the monitored device itself; use a clean device, and change the most critical accounts (email, bank, Apple/Google) first.
Keep a Simple Evidence Log
A dated log turns "I feel like I am being watched" into a pattern a detective or judge can act on. Keep it somewhere the suspected person cannot reach: a paper notebook stored safely, or a new cloud account created from a clean device.
- Date and time of each incident, as precisely as you can.
- What happened: what they knew, what the device did, what alert you received.
- How you know: screenshot, photo of the screen taken with another camera, saved email, witness.
- Where evidence is stored: so nothing gets lost when you need it months later.
Photographing the screen with a different device is often better than screenshots, since some monitoring software can see screenshots taken on the phone itself.
When to Involve Police, an Attorney, or a Forensics Expert
Installing monitoring software on another adult's phone without consent is illegal in most circumstances in the United States. Involve the police when there is any threat to your safety, when stalking is ongoing, or when you want the conduct on record; bring your evidence log. Involve an attorney when you are heading toward a protective order, divorce, or civil claim - and read our attorney packet first, because having your lawyer retain the forensics expert can protect the work under attorney work-product doctrine.
A forensics consultation makes sense when the stakes justify expert confirmation: you need to know, not guess, whether a device is compromised, and you need findings documented in a way that holds up. That work is exactly what Petronella Technology Group does, alongside digital forensics, personal and business cybersecurity, and hacked account recovery. One honest caveat, in writing: we do not perform Cellebrite-class physical phone imaging, and if your case needs that we will refer you to a lab that does.