Phone Tracking Checks Shift From Call Static to Account Audits

A familiar fear with better tools

"Is someone tracking me?" and "Is someone reading my messages?" have become ordinary consumer questions. Security vendors, tech publications and digital-rights researchers now publish step-by-step guides that cover two different threats. The first is software on the phone, often called stalkerware. The second is a physical Bluetooth tracker hidden in a bag or car.

The guides agree on more than they disagree, but the differences matter. Some still repeat older advice that does little to protect people. The best current guidance is to stop listening for clicks on phone calls and start checking settings, accounts and alerts. Both iOS and Android now have tools built for that.

What the warning signs actually are

Most guides give a similar list of symptoms. Kaspersky's October 2026 guide names fast battery drain, unexpected spikes in data use, and the camera or microphone turning on for no clear reason. It also stresses that no single symptom proves much, and that several appearing together is what should raise concern.21 Avast adds status-bar icons that appear when you are not using an app that needs them, strange incoming texts, and unexplained charges on your bill.22 Norton lists rapid battery drain, unexpected icons and apps you don't remember installing.23

Several guides make a quieter point that may matter more than any hardware symptom: the person watching gives themselves away. One explainer says the strongest sign is often a partner or ex who knows where you were or what you said privately, with no way to explain how.28 Another describes this as a non-technical sign that often shows up before anything odd happens on the phone.27

The advice also comes with a warning about disguise. Spyware tends to use dull, system-sounding names such as "System Manager," "Phone Health" or "Device Service" so that people scroll past it.21 Other guides give similar examples, including "System Service," "Device Health" and "Wi-Fi."28

Where the advice splits: call noise and secret codes

The clearest disagreement is about sounds on phone calls. Norton's US guide says frequent clicking, beeping or echoes could mean someone is listening in. It does add that network problems can cause occasional distortion.23 A September 2026 explainer makes a similar case for interference that persists across different networks.27 ClearVPN takes the opposite view and labels call noise a myth. It argues that reliable detection now depends on digital evidence such as data spikes, privacy-indicator activity and unfamiliar account sessions.25

ClearVPN's position is the better one. Modern phones log sensor access directly, so audio quirks are a poor substitute for those records. On iPhone, an orange dot means the microphone is in use and a green dot means the camera is.22 Android 12 and later show similar indicators and include a Privacy Dashboard with a timeline of which apps used which sensors and when.21 On iPhone, the App Privacy Report shows which apps accessed location, camera or microphone over the past week.27

Dial codes are a similar case. One consumer site lists star-and-hash codes and describes some as ways to check whether a phone is tapped or tracked.24 Norton's UK guide is more careful. It says codes such as *#21# and ##002# can show or turn off call forwarding, but they cannot detect spyware or reveal who is tracking you.26 Call forwarding is worth checking, and Kaspersky includes it in its four-step audit.21 It is not a spyware scanner.

The checks that matter most

The guides largely agree on what to check:

• Configuration profiles (iPhone). Look under Settings > General > VPN & Device Management. A profile you don't recognize could mean monitoring software was installed through an enterprise or developer certificate.21
• Device admin and accessibility settings (Android). These are where stalkerware usually gets its staying power. One guide points to accessibility services and device-admin apps the user never enabled.28
• Your accounts. These may matter most for iPhone users. In a KQED interview, the Electronic Frontier Foundation's Eva Galperin explained that iPhone stalkerware often uses the victim's Apple ID to make secret full backups. That gives the abuser data roughly once a day rather than in real time.20 The phone itself may look clean, which is why guides recommend reviewing signed-in devices and active sessions on Apple and Google accounts.25 Norton also warns that tracking through built-in sharing features may leave none of the usual symptoms, so it's worth checking who can see you in Find My or Google's location sharing.23
• Built-in safety tools. Apple's Safety Check, available on iOS 16 and later, lets you review sharing person by person. Its Emergency Reset option immediately stops all sharing.28

How well security apps catch stalkerware

Many guides tell readers to run a security scan, so the quality of those scanners matters. A 2025 test by AV-Comparatives and the EFF of Android security products found large gaps. Malwarebytes detected every stalkerware sample. Bitdefender, ESET, Kaspersky and McAfee each detected 94%. Google detected 53% and Trend Micro 59%.12 That low score for Google matters because some guides present a Google Play Protect scan as a first step for Android users.28 Play Protect is not useless, but on these results it should not be the only check. The same test found that one stalkerware sample stopped Norton's app from working properly.12

Galperin told KQED that detection has improved across the industry overall. She also said the number of Android stalkerware products she could find fell from 20 in early testing to 17.20 Academic work points to the limits. A 2025 review of 104 studies found that dual-purpose apps, which look harmless but can be misused, and developers' efforts to avoid detection continue to weaken antivirus tools.13

The other threat: physical trackers

Galperin has suggested that some abusers may be moving from spyware to physical tracking with AirTags and similar Bluetooth devices.17 Protection against those has improved a lot. Apple and Google built a cross-platform standard so that unknown-tracker alerts appear on both iOS and Android.1 On iPhone, broader tracker compatibility requires iOS 17.5 or later. Bluetooth, Location Services and tracking notifications must be on, and Airplane Mode must be off.1 Apple also recommends turning on Significant Locations, which helps the phone recognize when an unknown tracker has followed you to places like your home.1

Android 6.0 and later can raise these alerts.1 Users can also run a manual scan from Settings > Safety & emergency > Unknown tracker alerts.2 Android Police points out that the alerts only cover AirTags, devices on Google's Find Hub network and certain headphones.4 To fill that gap, one guide recommends the free AirGuard app, which looks for a wider range of Bluetooth trackers.27

If you find a tracker, holding a phone near an AirTag shows its serial number and part of the owner's phone number or email address.5 Apple suggests taking a screenshot of that information before disabling the device, and contacting police if you feel unsafe.5 Removing the battery stops the tag from sharing its location, but Macworld notes that it does not erase location data the tag has already sent.3

Removing it safely

The most important difference in the guidance is about what to do after you find something. One explainer calls a factory reset the most reliable fix when stalkerware is suspected.27 The AV-Comparatives and EFF report cautions that deleting stalkerware may alert the abuser. It argues that users should get an informed choice about removal, delivered through a secure channel.12 That caution comes from a real risk: the 2025 research review cites findings that victims of technology-facilitated stalking reported fearing physical harm or death.13 One guide suggests calling the National Domestic Violence Hotline (1-800-799-7233) before making sudden changes.27 Another notes that only a professional forensic examination preserves evidence in a form that can be used in court.11

For anyone in a dangerous situation, the order matters: write down what you found, make a safety plan, then remove the software. Wiping the phone first can destroy evidence and alert the person watching.

Why it matters: the data rarely stays private

The industry behind this software is also very insecure. TechCrunch has counted at least 27 stalkerware companies hacked or leaking customer and victim data since 2017. The most recent was uMobix, where a hacktivist published payment records of more than 500,000 customers.17 A 2025 breach at Catwatchful exposed phone data from at least 26,000 victims.17 Galperin says shutting companies down rarely ends them because operators simply rebrand.17

A person secretly monitored this way faces two risks: someone they know may be reading their messages, and strangers may later read them too after a breach. That is why the routine checks are worth doing. Several guides suggest a short monthly review of permissions, profiles, account sessions and tracker alerts.27