Phone tracking risks center on stalkerware and hijacked accounts

The question behind the guides

The question "can someone track my phone?" now drives a whole category of security writing. Norton has refreshed its guide on the subject for UK and Australian readers in early 2026, and VPN providers, antivirus vendors and independent explainer sites have published their own versions through the year. Most of these guides agree on the short answer, which is yes. Read closely, though, they also show something the headline question hides. The realistic threat to most people does not look like a film-style remote hack. It looks like a stolen account password, an app installed by someone who briefly had the phone, or a coin-sized Bluetooth tag dropped into a bag.

This piece looks at what the coverage says about three related worries: whether your phone has been hacked, whether someone is tracking your location, and whether someone is reading your messages and data.

How tracking actually happens

Norton's guide says the most likely way a phone gets tracked is through misuse of location-sharing features that are already built into apps and websites. Spyware and social-engineering attacks such as SIM swapping are the other routes it names.11 NordVPN's list is broader. It covers malicious apps, SIM cloning, Bluetooth tools, IP address monitoring and access to someone's iCloud or Google account. It notes that anyone holding your Apple ID or Google login can see your location and synced data using the tracking tools those services already provide.14

Cybrvault, a security firm, sorts the problem by what has actually been compromised. It names account compromise as by far the most common case. Next come stalkerware installed by someone with physical access, and SIM swaps, where the phone itself is fine but the carrier account has been hijacked.22 The firm also claims that 95% of "hacked iPhone" cases turn out to be a compromised Apple ID, a malicious configuration profile, or stalkerware installed by someone who knew the passcode. That figure comes from the firm's own casework, not an independent study, but it fits what the other guides describe.22

Kaspersky reaches a similar conclusion. It acknowledges that zero-click tools such as NSO Group's Pegasus can break into a phone with no action from the user. It also says that for most people, the realistic risk is stalkerware installed by someone who had brief access to an unlocked device.26 Kaspersky adds that Android phones are targeted by stalkerware more often than iPhones, though neither is immune.26 Several explainers say the same thing: consumer monitoring apps usually need someone to handle the phone first, so a strong, private passcode is one of the best protections.2419

The warning signs most guides agree on

The guides largely agree on the physical symptoms. Fast battery drain, a phone that stays warm while sitting idle, and sudden jumps in mobile data use appear in almost every guide. The explanation is that monitoring software runs all the time and has to upload what it collects.212530 Unfamiliar apps are another common sign, especially ones with dull, official-sounding names like "System Service" or "Device Health" that are easy to scroll past.192627

The more specific checks depend on the phone. On Android, stalkerware often registers itself as a device administrator, which makes it harder to uninstall. It may also abuse accessibility services to read the screen and record keystrokes, so both settings menus are worth reviewing.2730 On iPhone, the guides point to Settings > General > VPN & Device Management, where a configuration profile you don't recognise on a personal phone is a strong red flag.2219 Other iPhone warning signs include a Screen Time passcode you never set, jailbreak apps such as Cydia or Sileo, and unknown devices signed in to your Apple Account.28 Account-level warnings apply to both platforms: two-factor codes you didn't request, logins from unfamiliar places, and messages in your sent folder that you didn't write.2122

The sign many experts treat as most telling is not technical. Several guides say the strongest indicator is a partner, ex or relative who knows your location or the contents of private conversations without having been told.271923 Just as consistent is a warning against reading too much into one symptom. A single sign usually has an ordinary explanation, such as an ageing battery, and it is a cluster of signs that justifies a closer look.2430

Where the advice diverges

The biggest split in the coverage is between commercial privacy guides and safety-focused explainers. Many vendor guides put VPNs, private browsers and security apps near the top of their prevention lists.111518 A VPN does hide your IP address and encrypt your web traffic. But Cybernews, which also recommends VPNs, states plainly that a VPN cannot stop carrier cell-tower tracking or GPS logging on the device itself.17 A VPN also does nothing against an abuser who already has your iCloud password or has installed an app on your phone. My reading is that VPN-led advice answers a different question, about advertising and network surveillance, from the one most frightened users are asking.

Dial codes are a second point of confusion. Norton mentions codes that turn off or check call forwarding, but it is careful to say they don't detect spyware or show who is tracking you.11 Another explainer makes the same point more bluntly: codes like *#21# reveal only forwarding set up at the carrier level, while most modern monitoring happens through apps.24

Airplane mode is a third. Several guides describe it as cutting nearly all tracking.1215 Mysterium VPN notes that airplane mode does not turn off GPS, so location services need to be switched off separately.20 Detection tools also have limits. One forensic firm warns that consumer anti-malware catches known stalkerware but can miss custom or recently updated versions.28 TechJournal says the same about Google Play Protect.27

Safety before deletion

The most important advice in the coverage is also the least intuitive. When the person suspected of installing monitoring software is a partner, ex or family member, removing it right away can alert them, and their reaction could put the victim in danger. Several sources recommend thinking about personal safety and contacting support services before acting.212427 For removal itself, a factory reset is widely described as the most reliable fix. The guides add a caution: set the phone up as new rather than restoring an old backup, or restore only from a backup made before the compromise, and change account passwords afterwards.2127

Because account compromise is so common, securing the accounts often matters more than cleaning the phone. NordVPN recommends changing passwords, reviewing login activity, removing devices you don't recognise and turning on two-factor authentication for cloud accounts.14 On iPhone, explainers point to Safety Check under Privacy & Security as a way to review and cut off sharing in one place.19

Bluetooth trackers: better defences, real limits

Hidden tags are the one area where the platforms have made clear, measurable progress. Google added automatic unknown-tracker alerts to Android in July 2023.710 In May 2024, Apple and Google's jointly developed Detecting Unwanted Location Trackers (DULT) standard went live with iOS 17.5 and on Android 6.0 and later. Under that standard, phones on both platforms can warn users when a compatible tracker is moving with them while its owner is not nearby.10 Apple said tag makers including Chipolo, eufy, Jio, Motorola and Pebblebee had committed to making future tags compatible.7 Android users can also run a manual scan from Settings > Safety & emergency > Unknown tracker alerts, which takes about 10 seconds.71

The reporting differs on how much protection this gives in practice. Engadget concludes that most people will be warned if a tracker they don't own travels with them.9 Other coverage argues that AirTag stalking remains a problem.4 One retailer's guide says alerts usually arrive somewhere between 8 and 24 hours after a tag is separated from its owner. It also warns that modified tags sold with the speaker removed can defeat the audible warning.5 On iPhone, Engadget reports that Apple recommends turning on Significant Locations, which helps the phone tell when a tracker has followed you to places like your home.9

If a tag is found, the advice is to look for it only somewhere safe, which means not at home or at work. Scan it with NFC to record its serial number and owner details, screenshot that information, take out the battery, and report the incident to police.4

The bottom line

Taken together, the coverage points to one conclusion: phone surveillance is usually a problem of personal access, not a problem of network security. The best defences are a passcode nobody else knows, unique passwords and two-factor authentication on your Apple or Google account, regular checks of device-admin and profile settings, and tracker alerts left switched on. VPNs and security apps have their uses but are secondary. Anyone who thinks the person watching them is someone close should treat it as a safety issue first and a technical one second.