Our phones constantly leave digital footprints made up of metadata – the “data about data.” Metadata does not reveal the actual words spoken in a call or sent in a text; it records when you made the connection, who you contacted, and where you were located at that exact time. Combined, metadata creates a real-time map of your daily life. We essentially carry moving databases in our pockets, making them lucrative targets for cybercriminals, hostile actors, and commercial surveillance operators.
Beyond government-funded spyware like Pegasus and Predator, consumer-grade stalkerware targeted over 34,000 users worldwide in 2024-2025 alone, according to Kaspersky, with over 127,000 cases recorded between 2020 and 2025. High-risk targets range from journalists and activists handling sensitive data to ordinary individuals facing relationship control.
Rather than provoking panic, this guide breaks down how non-technical users can perform a step-by-step risk self-assessment and basic DIY forensics without needing complex “hacking” tools.
If you suspect a controlling partner or acquaintance installed stalkerware on your phone, do not immediately delete the software or alter settings from that device. Many stalkerware applications send instant alerts to the perpetrator when permissions are revoked or when the app goes offline, which can trigger real-world safety risks. Perform initial account checks using a separate, secure device, such as a trusted friend’s phone or a library computer.
Phase 1: Pen-and-paper risk assessment
Assess your baseline threat profile on paper. Ask yourself:
- Am I looking for quick loans or money-making opportunities via unverified apps?
- Am I an investigative journalist, human rights defender, or public critic of power?
- Do I store banking credentials, crypto keys, or confidential files on this device?
- Do I install apps from unauthorised third-party stores or click unknown links?
- Has an ex, partner, or family member displayed controlling behaviour or inexplicably known my exact location?
Mostly “No”: Your threat level is low. Maintain core digital hygiene, routine OS updates, strong passcodes, and revoke unused permissions.
One or More “Yes”: You face elevated risk. Move through the checks below.
Phase 2: Passive physical indicators
Watch for hardware anomalies over several days:
- Reboot behaviour: Does the phone take unusually long to restart or refuse to turn off?
- Sensor dots: Do green or orange indicators light up when you aren’t using camera or voice apps?
- Thermal and data spikes: Does your phone get warm while idle or show unexplained data consumption overnight?
Phase 3: Account and cloud audits
Bad actors frequently hijack linked cloud accounts to spy remotely:
- Active device sessions: Log into your Apple ID or Google Account settings from a secure browser. Sign out of anything unrecognised.
- Web messenger links: Check WhatsApp, Telegram, or Signal for “Linked Devices” or “Active Sessions.” A perpetrator can mirror your entire chat history by scanning your phone’s screen once.
- Location sharing audits: Verify that your real-time location isn’t being broadcasted to an unauthorised contact.
Phase 4: Deep settings audit
On Android: Check Settings > Accessibility for apps with screen-reading permissions. Navigate to Settings > Security > Device Admin Apps for apps with elevated system privileges.
On iOS: Navigate to Settings > General > VPN & Device Management. Rogue Configuration Profiles are a significant red flag.
Phase 5: Non-invasive DIY forensics
If symptoms persist, gather diagnostic logs:
- iOS system diagnose: Press Volume Up + Volume Down + Power for 1–1.5 seconds to generate a system snapshot.
- Android bug report: Enable Developer Options and select Take Bug Report.
Use open-source tools like MVT (Mobile Verification Toolkit), developed by Amnesty International, to scan your device against known Indicators of Compromise. For suspicious APK files, upload them to VirusTotal for analysis.
You do not have to tackle confirmed threats alone:
- Journalists, activists, and rights defenders: Reach out to Amnesty International’s Security Lab or Access Now’s Digital Security Helpline for free forensic assistance.
- Stalkerware and domestic abuse victims: Contact local domestic violence organisations or law enforcement before modifying or wiping your device. System logs serve as legal evidence, and abruptly removing stalkerware can alert an abuser before you have established physical safety.
Smartphone surveillance is no longer a concern reserved for spies and journalists. Ordinary people – students, job seekers, and individuals in controlling relationships – are increasingly targeted by consumer-grade stalkerware. The good news is that you do not need to be a tech expert to protect yourself.
By following the steps outlined in this guide – assessing your risk, observing physical indicators, auditing your accounts and settings, and running basic forensic checks – you can take control of your digital privacy.
