Checking an Android phone for spyware or suspicious apps

If you’re helping someone who suspects their Android phone might be monitored, here’s a practical, non-technical guide you can use to check for signs of tracking or spyware. You don’t need to be a tech expert — just take your time and follow these steps carefully.

1. Install Malwarebytes from a USB stick

If you can’t trust the phone’s app store, it’s safest to install a known antivirus tool manually. You’ll need:

  • A USB stick with the Malwarebytes APK file already downloaded (from the official Malwarebytes website)

  • A USB OTG adapter (lets you plug the USB stick into the phone)

Here’s how:

  1. Plug the USB stick into the phone using the adapter.

  2. Open the Files app (sometimes called “My Files” or “File Manager”).

  3. Find the Malwarebytes file — it ends in .apk.

  4. Tap it. You’ll get a warning about installing apps from “Unknown Sources.”

  5. Follow the prompt to temporarily allow this. It’s safe if you trust the source (i.e. your USB stick).

Once installed, you can remove the permission again for extra safety.

2. Run a full scan

  1. Open Malwarebytes.

  2. Tap Scan.

  3. Wait about 10–15 minutes while it checks the whole phone.

It will alert you if it finds anything dodgy — malware, spyware, or apps behaving badly behind the scenes.

3. Check for suspicious apps

Even if Malwarebytes doesn’t find anything, it’s worth having a look yourself.

  1. Open Settings.

  2. Go to Apps or Apps & notifications.

  3. Tap See all apps or Manage apps.

  4. If needed, tap the three dots in the corner and select Show system apps.

Now scroll through the list. You’re looking for anything that:

  • Has odd names like “SystemService” or random letters (e.g., “xzy.track.android”)

  • Includes words like track, monitor, spy, remote, or stealth

  • Pretends to be something harmless, like a calculator or notepad

A Manchester shelter found 17 phones with “KidsGuard Pro” hidden behind fake calculator icons. No one had noticed until permissions and background activity gave it away.

If you see something strange and don’t know what it is, make a note and look it up later — or ask a tech support person you trust.

4. Review app permissions

Sometimes the apps themselves aren’t suspicious — but what they’re allowed to do is.

Here’s how to check:

  1. In Settings, go to Apps again.

  2. Tap App permissions or Permissions manager.

  3. Go through categories like Location, Microphone, Camera, SMS, and Phone.

  4. Ask: Does this app really need access to this?

If a weather app or calculator has microphone access, that’s a red flag.

You can revoke permission by tapping the app and selecting Don’t allow or Deny.

Notes

If you’re ever unsure about an app or can’t tell what it’s doing, it’s safer to block its permissions or remove it altogether — especially on a phone used by a survivor.

And write things down. Keep a record of what you find in case you need to report it to law enforcement or a support organisation.

Last update: 2025-06-11 07:09