Situation

You suspect a problem with your phone: what to check

Written and reviewed by Hans Mourette, President of Datashield Risk Consulting (Galyct) · Updated 16 August 2026

Battery drain, slowness, ads or unusual behaviour do not on their own prove a hack. Start by checking updates, installed apps, permissions, linked accounts and connected devices. Not every anomaly is evidence, and uninstalling is not always enough.

~5 min read · we will never ask for your codes or your passwords.

Do this right away

Three steps, without rushing: cut the connections (aeroplane mode) if unusual activity is under way, but without switching off or resetting. Don’t delete anything for now: take screenshots of the useful apps, messages and alerts first. And secure your accounts from another trusted device, never with a tool offered by a stranger.

Request a call back → Immediate reflexes

HOW IT HAPPENS

Recognising a compromised phone

A single symptom proves nothing: it is several signs together that should alert you. Here are the three groups to look at.

On the device

Unknown apps or apps installed outside the official store, very broad permissions (accessibility, “administrator”, display over other apps), sudden slowness, overheating and a battery that drains fast, unusual pop-ups or ads.

On your accounts & messages

Texts or calls you didn’t make, strange messages received by your contacts in your name, call forwarding, two-factor authentication codes you didn’t request, or a sudden loss of network signal (possible SIM card hijacking).

To be weighed up

A weak battery, overheating or slowness can have a thousand ordinary causes (the age of the device, an update, a power-hungry app). The aim is to separate facts, anomalies and assumptions, not to conclude there has been a hack on a single clue.

STEP BY STEP

Secure your phone in the right order

Four stages, from the most urgent to the most considered. The right order avoids destroying useful traces or leaving your linked accounts accessible.

01IsolateCut the connections, without switching off or resetting

02KeepScreenshots of apps, permissions and messages

03CheckApps, profiles, accessibility, accounts and sessions

04SecureRevoke access, then decide on a factory reset

01 · Isolate, without breaking everything

If unusual activity seems to be under way (messages being sent, transactions), cut the connections by switching to aeroplane mode. However, don’t switch off or reset straight away: a reset done too soon often erases items that help to understand what happened.

02 · Keep what helps you understand

Take screenshots: the list of installed apps, permissions granted, unusual messages or alerts, visible logs and the exact times of the anomalies. These items establish a useful timeline for your formal steps, even if they do not, on their own, prove a compromise.

03 · Check methodically

A serious check is not just running an antivirus. Depending on your system, go through:

Apps: those you don’t recognise, installed outside the official store, or recently added (including remote assistance tools).
Sensitive permissions: accessibility, device administrator, display over other apps, texts, contacts, microphone, camera, notifications.
Network & profiles: VPN, private DNS, configuration profiles, certificates, saved Wi-Fi networks, call redirects and forwarding.
Accounts & sessions: Google or Apple account, messaging apps, bank, cloud and social media, which can remain exposed even after an app is deleted.

04 · Secure, then decide

Revoke unknown access, sign out devices you don’t recognise, then change your passwords from a clean device and turn on two-factor authentication wherever possible. Only then, once the accounts are secured and the evidence kept, should you decide whether to reset the phone, not before.

THE FORMAL STEPS

Who to contact, depending on your case

Not all of them apply to every situation. Keep the ones that match what you noticed.

Your mobile operator

If you lose network signal for no reason, if calls are being redirected or if you suspect your SIM card has been hijacked, contact your operator to block the line and get a new SIM. This is often the first step when two-factor authentication by text is involved.

Your bank

If a banking app is installed on the phone or if you see a transaction you did not authorise, call your bank without delay to block your card and secure your access. Keep the records (amounts, dates, messages).

Reporting

Report the incident on Cybermalveillance.gouv.fr, the one-stop cyber assistance service, and use its fact sheets. It guides you free of charge and helps assess what is happening to you.

The police report

If you have suffered a loss (fraud, identity theft, extortion), file a police report: at a police station, a gendarmerie, or online depending on the case. The evidence you have kept makes this step much easier.

THE TRAPS

What to avoid, and what not to conclude too quickly

Some reflexes make the situation worse or destroy evidence. Keep them in mind.

Don’t rush to reset: a reset done too soon deletes useful items before you have even kept them.
Don’t conclude there has been a hack on a single symptom: a battery that overheats or slowness prove nothing on their own.
Don’t install any tool offered by a stranger during the incident, and never give remote control to someone who calls you.
Don’t just change the unlock code: you also need to secure the accounts linked to the phone and revoke unknown sessions.
Don’t delete suspicious messages or alerts: they serve as evidence for your formal steps.

Get help, with no commitment

The free diagnosis assesses your situation, identifies the useful evidence and tells you whether you need a check, a fix or simply some support. Galyct Perso checks, secures, documents and advises, but does not replace your bank or the police, and guarantees no result: no identification of the culprit, no recovery of funds. Commitments, not promises. We will never ask for your codes, and your data stays in France.

Start my free diagnosis → Call 09 73 37 47 16

Official sources: Cybermalveillance.gouv.fr.

KEEP GOING