iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Start with Google Play Protect, install Android and security updates, remove apps you do not trust, and review your Google Account security. If monitoring continues, Google says a factory reset or help from the phone manufacturer may be necessary. However, if a partner, family member or another person may be watching the phone, do not immediately delete anything: stalkerware (spyware installed for secret personal surveillance) can alert the person monitoring you or destroy evidence. Use a safer device and make a safety plan first.
What spyware and stalkerware mean on Android
Spyware is software that secretly collects information such as messages, location, calls, files or account activity. Stalkerware is a form of spyware used by another person to monitor someone without their informed consent, often in a coercive or abusive relationship. It may be installed as an ordinary-looking app, granted powerful accessibility or device-administrator permissions, or enabled through access to an online account rather than through a suspicious app.
Battery drain, unusual data use, settings you did not change, unknown apps, unexpected pop-ups or someone knowing private details can be warning signs. They are clues, not proof. The same symptoms can come from a failing battery, ordinary app bugs, shared accounts, location sharing, a compromised cloud account or someone who knows your passwords. A clean Play Protect scan does not prove that no monitoring exists.
That distinction matters because the fix depends on the route. Removing an unfamiliar app can help when the app itself is harmful, but it will not remove access granted through a Google, carrier, cloud or social account. Conversely, changing a password may not remove software already installed on the handset. Treat the phone, its accounts and the safety of the person using it as separate parts of the problem.
#1 Best Overall
Choose a safe response before changing the phone
When another person may be monitoring you
NNEDV Safety Net Project advises: “Before looking for or trying to remove stalkerware, think about your safety.” A person who loses access may react, and changing the phone can erase evidence you may later need. Assume activity on the suspected phone could be visible if the other person has access to it, its accounts, its carrier records or its notifications.
- Use a friend’s, library’s or work device that the person cannot access for sensitive searches and support calls.
- Contact a domestic-violence, stalking or technology-safety advocate before removal if doing so is safe. An advocate can help weigh privacy, evidence and the risk of escalation.
- Do not announce that you are investigating or removing monitoring if that could increase danger.
- If evidence may matter, record dates, messages or screenshots from a safer device rather than altering the suspected phone first.
- Consider whether the other person controls the phone plan, a shared email address, cloud storage or recovery phone. Those channels may reveal password changes or a new device.
There is no universally safe moment to uninstall an app or reset a phone in an abusive situation. A sudden loss of location or account access can be noticed. An advocate can help plan a safer device, preserve evidence and decide whether immediate privacy or a quieter transition is the priority.
When there is no personal-safety concern
You can normally begin with Google’s built-in malware checks and routine account and software maintenance. Keep the phone connected to a trusted network, and avoid installing another “cleaner” or security app simply because an advertisement claims the phone is infected.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Step 1: Run Google Play Protect
Play Protect is Android’s built-in app scanner. Google says it checks apps installed from Google Play and other sources, can warn about potentially harmful apps, and may disable or remove an app it identifies. It is a useful first check, not a guarantee that every spyware or stalkerware installation will be found.
- Open the Google Play Store.
- Tap your profile picture or initial in the upper-right corner.
- Tap Play Protect.
- Check that app scanning is enabled, then tap the option to scan the device.
- If Google flags an app, read the warning and follow the removal or disable prompt. Do not ignore a warning merely because the app has a familiar name.
For apps installed outside Google Play, Google recommends turning on improved harmful-app detection in Play Protect. The wording and location of that setting can vary by Android release. If the scan reports no threats but the concern involves a person who may have access to your accounts, continue with the account and safety steps below.
Play Protect’s result is an action signal, not a forensic certificate. A warning means Google has identified a potentially harmful app and you should follow the prompt; a clean result means only that this scan did not identify a threat. Monitoring through a legitimate app with excessive access, a signed-in account or another device may not present as a Play Protect detection. Keep scanning enabled after cleanup rather than turning it off to make an app work.
Step 2: Update Android and inspect installed apps
Install all available system updates
In Settings, look for sections such as System, Software update, Security and privacy or About phone. Check separately for:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute- Android system updates
- Android security updates
- Google Play system updates
Manufacturers place these controls differently, and some updates require a restart or Wi-Fi connection. If your menus do not match, use the phone maker’s support instructions for your exact model and Android version.
Write down the Android version, security-update level and model before making major changes if you may need support later. Updates can change menu names and permissions, so a guide written for a different release may not match what you see. Do not interrupt an update or use firmware instructions intended for another model.
Review every installed app
Open Settings and find Apps, Apps & notifications or a similarly named app-management screen. Sort or browse the complete list, including apps that are disabled or hidden behind a system-app filter. For each app you do not recognize, check its name, icon, installation source, permissions and recent use.
Pay attention to apps with access to accessibility services, device administration, notifications, SMS, location, microphone, camera or files. Those permissions can be legitimate for some apps, so the permission alone is not proof of spyware. If an unfamiliar app has unusually broad access, note its details and seek model-specific help before revoking a permission that could affect phone operation.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Remove an app only when doing so is safe. Google’s general path is to select the app and tap Uninstall; you can also uninstall many apps from the Play Store by opening the app’s listing and tapping Uninstall. Menu labels and the ability to remove preinstalled software vary by Android version and manufacturer. An app that cannot be uninstalled may be a system component, may have device-administrator privileges, or may be protected by the manufacturer. Do not disable a core service at random; seek model-specific guidance instead.
If an app disappears from the launcher but remains in the installed-app list, it has not necessarily been removed. Check the full list and the app’s storage and permission screens. If the phone reports that an administrator must be removed first, do not guess at a workaround; document the message and consult the manufacturer or a trusted support professional.
Step 3: Secure the Google Account and connected accounts
Spyware on the handset is only one possible route to private information. Someone who knows your Google password, has a signed-in browser session, controls a recovery method or can access a shared cloud, carrier-billing or other connected account may still see information after an app is removed.
Review Google security
- Open your Google Account settings and run Security Checkup.
- Review recent security activity, signed-in devices, recovery phone numbers and email addresses, saved passwords, third-party access and two-step verification methods.
- Sign out devices or sessions you do not recognize, and remove third-party access you no longer trust.
- Change the Google password if another person may know it. Use a unique password that is not reused elsewhere.
Check the account from a safer device when possible. A session that looks familiar may belong to a shared tablet, old browser or another person; sign it out if you cannot verify it. Make sure recovery details are controlled by you, because an attacker who retains a recovery phone or email may be able to regain access after a password change.
If the person who may be monitoring you controls the phone, its email account or its recovery channels, make these changes from a safer device and account. Changing credentials on the monitored phone can reveal your plan or leave the attacker with a way to reset the password.
Check other accounts
Consider the carrier or phone-billing account, cloud storage, messaging and social accounts, password manager, smart-home services and any account that receives phone notifications. Change credentials from a device the other person cannot access, review active sessions, and enable two-factor authentication where it will not create a safety problem. Make sure the new recovery email address and phone number are also private.
Two-factor authentication improves account protection, but its setup can create a new notification or depend on a phone the other person controls. Choose a method that is private and reachable, and store recovery codes somewhere safe. If a carrier account is shared, ask the carrier about account access and billing notifications from a safer channel rather than assuming a handset reset changes the account.
Step 4: Decide whether to factory-reset the phone
Google’s Android malware guidance says: “If you find signs of malware, you might need to reset your Android device or ask the company that made your device for help.” A factory reset is a major recovery step, not a routine scan.
Recommended Free Tools
What a reset does
A factory reset erases data stored on the phone and uninstalls apps and their data, returning the device to its setup state. It can remove persistent harmful software, but it also deletes photographs, messages, downloads, authenticator data and other information unless you have safely preserved it. A reset does not automatically secure a compromised online account, and it cannot undo information someone already copied.
Resetting also takes time: you must set up the phone again, sign back into accounts and reinstall essential apps. Plan for that interruption, especially if the phone is needed for work, transport or two-factor authentication. Keep the old phone untouched if evidence or a safety advocate may need to review it, rather than assuming the reset is reversible.
Prepare before resetting
- Confirm that you know the Google Account credentials previously used on the phone and the current screen-lock credential. Android’s theft protection may require them during setup.
- Back up only information you genuinely want to keep, using an account or storage location the suspected person cannot access.
- Export or otherwise protect items that ordinary backups may not include, such as authenticator codes, recovery codes, contacts stored locally and important evidence.
- Read the manufacturer’s reset instructions for your exact model. Menu names and reset behavior differ across devices.
- Charge the phone and connect it as Google’s reset instructions require before starting.
Do not rely on a backup you cannot inspect. Know which apps, settings and files it contains and who can access the backup account. In a personal-safety situation, preserving evidence separately may be more important than creating a complete restore point.
Reset when safety and data plans are ready
Use the reset command in the phone’s Settings, following the manufacturer’s documented path. Do not interrupt the process. During setup, install system updates before normal use, create a screen lock that the other person cannot guess, and review privacy and permission prompts carefully.
After setup, avoid signing in everywhere at once. Secure the main Google Account first, then install only essential apps from trusted sources and review each permission request. This makes it easier to notice an app or setting that causes the original behavior to return.
Be careful with backup restoration
NNEDV Safety Net notes that a factory reset may remove stalkerware, but restoring apps or files from a backup can put it back. In a suspected stalkerware situation, do not automatically restore every app and setting. Reinstall only essential apps from trusted sources, one at a time, and check permissions before granting access. Preserve important evidence separately from a full-device restore.
Step 5: Get manufacturer help when symptoms remain
If suspicious behavior continues after Play Protect, updates, app review and an appropriate reset, contact the phone manufacturer through its official support channel. Provide the exact model, Android version, symptoms, dates and steps already taken. Manufacturer support can identify model-specific menus and explain how to restore the original operating system.
Be especially cautious with rooted or otherwise modified phones. Google says normal Android security protections may be reduced on a device with a modified operating system. Do not improvise firmware commands from an unrelated model. Use manufacturer-specific instructions or qualified support to restore the original software, and back up essential data first if it is safe to do so.
Free tools Windows power users keep installed
One-click scans. No signup required.
Use an official support page or a support number you independently verify. If another person may monitor the phone or account, do not disclose sensitive safety details through a chat or email they can read. A manufacturer can help with the device software, but it cannot determine whether someone has access to a separate cloud or carrier account.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Which response fits your situation?
| Response | Best use | Benefits | Risks and limits |
|---|---|---|---|
| Play Protect, updates and manual app review | Routine malware concerns when personal safety is not at issue | Built into Android; can warn about, disable or remove some harmful apps | Not conclusive proof that all spyware or account access is gone; menu paths vary |
| Factory reset | Persistent signs after initial checks, following Google and manufacturer guidance | Deletes phone data and app data and may remove persistent software | Data loss; requires account credentials; restoring a backup can reintroduce stalkerware |
| Safety planning and a safer device | Possible stalkerware, coercive control or a person who may react to losing access | Reduces the chance that research or account changes are observed; protects evidence and support-seeking | May delay technical cleanup; changing the phone can alert the person or erase evidence |
| Manufacturer or qualified technical support | Unclear menus, unresolved symptoms or modified system software | Provides model-specific reset and operating-system guidance | Support may require access to account or device details; avoid sharing sensitive information through a monitored channel |
Common mistakes to avoid
- Treating symptoms as proof: battery drain or heat alone does not establish spyware. Check apps, updates and account sessions before drawing conclusions.
- Relying on one scan: Play Protect is an important first step, but it cannot guarantee that every monitoring method has been found.
- Resetting without preparation: Losing local data or being locked out because you do not know the Google Account credentials can make recovery harder.
- Restoring everything automatically: A backup can bring a stalkerware app or unsafe configuration back to the reset phone.
- Changing passwords on a monitored device: The other person may see the new password or receive a notification. Use a safer device whenever possible.
- Installing an unknown “security” app: An additional app with broad permissions can create another privacy risk. Start with Android’s built-in tools.
- Following instructions for the wrong model: Firmware and reset procedures are not interchangeable. Confirm the exact manufacturer, model and Android version.
- Assuming a reset fixes every route: Account sessions, carrier access and information already copied by another person are not erased by wiping the handset.
After cleanup: make monitoring harder
Keep Android, security components and Google Play system updates current. Leave Play Protect scanning enabled, install apps from trusted sources, and review permissions when an app requests access to location, accessibility, notifications, SMS, microphone, camera, files or device administration. Use a strong screen lock and do not share it. Periodically review signed-in devices and connected-account sessions, especially after lending the phone or changing a password.
Review the complete installed-app list occasionally, not just the home screen. Remove apps you no longer use when it is safe, and investigate unfamiliar additions before granting them broad access. Keep recovery email addresses, phone numbers and two-factor methods private and up to date.
If the concern involved an abusive or coercive person, technical cleanup is only one part of safety. Continue using a safer device for sensitive account recovery, support contacts and documentation until you are confident that the person no longer controls any relevant account, device or recovery method.
Frequently Asked Questions
Can Play Protect prove that my Android phone has no spyware?
No. Play Protect checks apps from Google Play and other sources and may warn about, disable or remove harmful apps, but Google does not present a clean scan as proof that every spyware installation or account-based monitoring method is gone.
Should I remove an unfamiliar app immediately?
Only if doing so is safe. If another person may be monitoring the phone, removal can alert them or erase evidence. Use a safer device and consider an advocate first. Otherwise, review the app’s source and permissions, then use Android’s normal uninstall control or Google Play’s Uninstall option.
Will a factory reset remove stalkerware?
A reset may remove stalkerware, but it erases phone data and apps. Restoring a backup can put the monitoring app or unsafe configuration back. Secure accounts separately and reinstall only essential apps from trusted sources when safety allows.
What if I do not recognize the Google Account or screen-lock credentials?
Do not reset until you understand the account requirement. Android may require the previously used Google Account and screen lock during setup. Recover access from a safer device or contact the manufacturer through an official channel.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteCan spyware remain if no suspicious app appears?
Yes. Someone may have access through a Google, cloud, carrier-billing or other connected account, or through a signed-in session. Review Google Account Security Checkup, active sessions, recovery methods and connected accounts.
What should I do if the phone is rooted or modified?
Google says normal Android protections may be reduced on a modified operating system. Do not use firmware instructions for another model; ask the manufacturer or qualified support how to restore the original software.
The Bottom Line
Run Play Protect, install Android and security updates, review and safely remove untrusted apps, and secure Google and connected accounts. If signs persist, prepare carefully for a factory reset or contact the manufacturer. When another person may be monitoring you, use a safer device and make a safety plan before changing the phone.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →
