My Phone May Be Hacked: What Should I Do First?

What should I do in the first few minutes?

For suspicious payments, contact the payment provider immediately and ask what can be stopped or recovered. Recovery is not guaranteed. ^[1]

Start with what happened: a payment you did not make, an account you cannot access, or messages sent without your permission. Deal with the immediate loss first, then investigate how it happened.

If a partner or someone close to you may be monitoring the phone, consider personal safety before changing it. Removing their access can alert them. Use another device to seek help if doing so is safe. ^[9]

For everyone else, use this order:

1. Stop following instructions in the suspicious message or call.
2. Borrow a trusted device if possible. Do not use a stranger's phone or an unfamiliar repair kiosk for passwords.
3. Deal with money currently at risk.
4. Secure the account that controls recovery for your other accounts.
5. Record the incident, then investigate the phone.

As of 4 November 2026, this is general security information, not a diagnosis or individual legal or financial advice. Choose the steps that match what actually happened.

What if money has already left my account?

Call the bank through a known contact, such as the number on your card, and report the suspicious payment. Ask about protecting exposed payment access. ^[1]

Explain whether you made the transfer after being deceived or did not authorize it at all. Ask which review process applies to your case; do not assume foreign refund rules apply to an Iranian account.

Have a short note ready: payment date and time, amount and currency, transaction reference, destination details shown on the receipt, and what happened just before the payment. Read from the note rather than trying to reconstruct everything during the call.

Ask the person handling your report to explain the next step in plain language. Useful questions are: Which access has been blocked? Can another payment still leave this account? What reference should I quote when following up? Which documents do you need, and through which channel?

Write down the answers. Mark uncertain details as uncertain. If a family member helps, give them a specific job, such as organizing receipts, while you handle the bank conversation. Do not delay that conversation to finish a perfect evidence folder.

Which account should I secure first?

Start with the email or platform account used to recover other accounts. For Google, review recent security events, signed-in devices, recovery details, and unfamiliar Gmail forwarding or filters. Change the password and remove access you do not recognize. If you cannot sign in, use Google's account recovery process. ^[2]

For an Apple Account, change or reset the password, review account information, and remove unfamiliar devices. Check that you still control the associated email addresses and phone numbers. Apple's recovery process is the appropriate route if you cannot regain access directly. ^[3]

Do these tasks from the trusted device where possible. Make a short checklist of the accounts involved, starting with those that can reset the others. Avoid changing ten passwords in a rush and then forgetting which changes succeeded.

For a messaging account, use Pouyam's WhatsApp and Telegram account recovery guide. Record whether you still have a working session, whether your recovery address changed, and whether contacts received messages you did not send. Those are useful facts to carry into the relevant recovery process.

Could someone have taken over my phone number?

A SIM swap transfers a phone number to a SIM or eSIM controlled by someone else. The Canadian Centre for Cyber Security explains that this can expose calls and verification messages and help an attacker enter other accounts. Losing cellular service together with unexpected account changes deserves urgent attention. A lost signal alone does not establish the cause. ^[4]

Contact your mobile provider through an independently verified channel. Ask whether a replacement SIM, number transfer, or account-detail change occurred. Describe the time service stopped and any related account alerts. Ask what protections the provider actually offers; do not assume that a feature available overseas exists for your Iranian subscription. ^[4]

Keep the phone-number problem separate from the handset problem in your notes. Write two headings: “Mobile line” and “Online accounts.” Under each, list the provider contacted, its response, and the action still needed. This keeps the investigation focused if different companies give different explanations.

For accounts that support it, consider verification methods that do not depend only on the phone number. Check recovery options before making that change so you understand how to regain access later. ^[4]

What if I installed an app from a message?

On Android, Google's malware-removal guidance starts with Play Protect, security and system updates, removing untrusted apps, and an account security check. If problems persist, the next step may involve a reset or help from the manufacturer. This is a cleanup route, not proof that every unusual symptom is malware. ^[5]

Before changing anything, note the app name, where you obtained it, and what you remember granting it. Be precise: “I downloaded a file” and “I installed an app and enabled its requested permissions” describe different events. Do not reopen a suspicious link just to improve the record.

Separate device access from access you gave an online service. Google lets you review connections with apps from other developers and remove access you no longer want. Removing that connection does not erase information the other service already received. ^[11]

Ask a helper to explain any proposed action before they perform it. “This removes the app” is different from “this changes your account password.” Keep those actions as separate checklist items. Do not hand over every account credential merely because the helper offers to fix everything at once.

What evidence should I keep?

Preserve relevant messages, account alerts, payment receipts, and a dated timeline. Safety Net's documentation guidance recommends recording the context and considering whether the place used to store evidence is safe from the person causing harm. Some apps notify others about screenshots; choose a safer way to record the screen where needed. ^[8]

Use a simple note with these fields: what you observed, when you observed it, where the original record is stored, and what action you took. Keep observations separate from guesses. Write “an unfamiliar device appeared in account settings,” rather than naming an attacker without evidence.

For example, an incident note might read: “At 18:20, I saw a payment I did not recognize. At 18:28, I called the number on my card. The bank gave reference A. At 18:45, I changed my email password from another device.” Replace every example detail with your own record.

Keep unedited originals and use separate copies for explanations or redaction. Do not post private messages, identity documents, or complete payment details publicly to ask whether the incident looks serious. Choose the recipient and purpose before sharing the file. ^[8]

Should I erase the phone immediately?

A verified Apple threat notification needs a different response from an ordinary nuisance app. Apple says these notifications concern individually targeted mercenary spyware attacks. Verify the notification by navigating independently to the Apple Account website and signing in. Genuine notifications do not require you to install software or disclose a password or verification code. ^[6]

For this kind of incident, Access Now advises preserving the device for possible investigation rather than immediately erasing it. Its guidance also recommends updating the operating system and considering Lockdown Mode. An erase is not a guarantee against future targeting. ^[7]

For unwanted sharing on an iPhone with iOS 16 or later, Safety Check can review sharing with people and apps. Its Emergency Reset option stops sharing more broadly; Manage Sharing & Access supports a selective review. Consider the personal consequences before stopping access. Safety Check is not presented as a spyware detector. ^[12]

Before approving an erase, write down the purpose: remove a suspected app, prepare a replacement phone, or follow an expert's recovery plan. Then ask what evidence and personal data must be preserved first. If nobody can explain that, pause the erase and get a clearer plan.

Who can help, and what should I ask?

Access Now's Digital Security Helpline offers free assistance to civil society, including journalists, activists, and human rights defenders. It checks whether a request falls within its mandate. It is not a general phone-repair service or a bank-refund service. People facing a targeted digital attack related to their work can consult its help page. ^[10]

For a complaint in Iran, IranWire describes submission through judicial service offices with relevant seller details and payment records. It does not guarantee finding the suspect. ^[13]

Before choosing that route, consider confidential advice from an independent lawyer about your circumstances and disclosure risks.

For an initial conversation with a trusted technical helper, prepare three questions: What evidence supports your diagnosis? Which action do you recommend first, and why? What will that action erase or change? Ask them to distinguish a confirmed finding from a possibility.

Finish the first response with a short handover note. List accounts secured, payments reported, mobile service checked, evidence saved, and unresolved questions. Put a next action beside each unresolved item. For broader prevention after the emergency, browse Pouyam's online security guides.