Guide · Device safety · October 2026 · by Stefan Tsezarov

Is my phone being watched?

Someone mentions a private conversation. They know where you went, even though you never told them. You notice a device you do not recognise in your account.

You want an answer. A phone check may help, but first it matters how someone could be getting that information. They might have access to an account, a location-sharing setting, or an app on your phone. Each needs a different response.

01Watching does not always involve spyware

A person with access to your email or cloud account may be able to read private information from their own device. Shared location settings and linked messaging sessions can expose information too. There may be nothing unusual installed on your phone.

Monitoring apps are another route. They can collect information such as location or messages, depending on their permissions and the device. An app advertised for “family safety” can still be used to monitor someone without their knowledge or agreement. Its marketing does not tell you whether its use is acceptable.

Then there is mercenary spyware, such as Pegasus. These are sophisticated tools associated with targeted attacks against people including journalists, activists and public figures. Some attacks require no tap on a link. They are a different problem from an account someone else can sign into. Apple explains targeted spyware attacks here.

02What deserves a closer look?

A hot phone or a battery that drains quickly cannot tell you whether you are being watched. Those symptoms have many possible causes.

More useful things to investigate include:

• Unrecognised account access: a signed-in device, linked session or recovery address you did not add.
• Unexpected sharing: your location or other information being shared with someone you did not intend.
• Unfamiliar permissions: an app with accessibility, notification or device-administrator access you cannot explain.
• A pattern of private knowledge: someone repeatedly knows details they should not have access to.
• A verified security warning: a provider tells you that your account or device may have been targeted.

An unfamiliar setting may have an ordinary explanation. These are starting points for investigation, not proof of spyware. Equally, finding none of them does not establish that everything is safe.

03If you are worried about a partner, ex-partner or family member

You do not have to confront them or remove anything immediately. If someone is controlling or threatening, losing access to your information could change their behaviour.

Start with a domestic-abuse or victim-support service, using a device and account they cannot access where possible. Explain that you suspect digital monitoring and want help planning what to do next. Avoid signing into a potentially monitored account on the safer device.

Keep a record only if it is safe. Dates, messages and photographs taken with another device may be useful. Screenshots saved on the phone could sync to an account the other person can see. Do not put yourself at risk to collect evidence.

On a supported iPhone, Settings → Privacy & Security → Safety Check lets you review sharing and account access. Before using it, consider what the other person might notice when access stops. It helps manage sharing; it is not a spyware detector. Apple's Safety Check guide explains the options and safety considerations.

04If you think you are being targeted because of your work

Seek specialist advice before resetting the phone or trying to remove suspected spyware. A reset can destroy information that would help an investigation.

Access Now's Digital Security Helpline provides free, round-the-clock assistance for eligible civil-society users, including journalists, activists and human-rights defenders. You do not need to run our check first. The service assesses whether a request falls within its remit.

If you receive an Apple threat notification, verify it by navigating to account.apple.com yourself. Apple says these notifications do not ask you to install software, open files, or provide your password or verification code by email or phone. Take a genuine warning seriously and seek expert help. Apple's guidance also explains when to consider Lockdown Mode. Read Apple's advice.

05What our spyware check can tell you

The SaveSaveSaveSave spyware check compares supplied information with published indicators: known domains, app identifiers and other recorded traces associated with particular spyware or monitoring apps.

You can check pasted text or a link in your browser. The Android route is an advanced option that needs a collection made with a separate tool on a computer. Neither route is a complete examination of your phone. The website does not currently examine iPhones or computers directly.

The selected content is processed in the browser rather than uploaded for analysis. Opening the website and downloading its indicator lists still involves network requests; the privacy notice explains those connections.

Coverage is limited to the sources included in this release. It does not cover every spyware family or version, including later Pegasus indicators, Predator, Graphite, Candiru or Cellebrite. Check the tool's coverage panel for the included sources, their dates and any lists that could not load.

A match needs context. A listed domain in a pasted message does not prove the phone was infected. Even an exact match must be interpreted according to what was compared and where it was found. Do not open a suspicious address to investigate it.

No match leaves questions unanswered. The check cannot find indicators missing from its lists or traces in data it could not read. Checking a message does not examine the device that received it.

If a finding concerns you, save the result somewhere safe and seek appropriate help. If someone close to you may be monitoring you, make a safety plan before running a collection or changing anything on the phone.

This guide gives general safety information, not legal advice. Help services differ by country and by who they serve.