In short
There is no single everyday symptom that proves someone is listening to your phone. Check specific evidence: microphone use, unexpected sharing, unfamiliar account access, or a verified security alert. Ordinary heat has other explanations, while advanced spyware may require expert investigation. Choose checks that are safe for your circumstances. [1][2][7]
Key takeaways
- Treat a symptom as a reason to investigate, not as an identification of an attacker.
- Separate microphone access, location sharing, account access, and network-based tracking.
- Check which app used a permission and whether that use makes sense.
- Consider personal safety before cutting off access that an abusive person may be monitoring.
On this page 12 sections
- Does a hot phone mean someone is listening?
- What do the orange and green dots actually show?
- How can I check sharing without making things worse?
- Is location tracking the same as microphone surveillance?
- What does documented spyware targeting tell us?
- What if Apple sends a threat notification?
- Can an app or a dial code prove my phone is clean?
- How should I document concerns and seek help?
- Common mistakes
- Frequently asked questions
- Glossary
- Sources
Does a hot phone mean someone is listening?
No. First-time setup, restoring a backup, wireless charging, and intensive activities can make a phone warm during ordinary use. A warm phone is not, by itself, evidence of secret recording. Record when the heat occurs and what the phone is doing before deciding it is a security incident. [1]
Changes in battery use, data use, and device behavior deserve more attention when someone also knows private details or has had unsupervised access to the device. These clues justify checking; they do not identify a particular tool or person. [4]
Start a note with two columns: “What I observed” and “What I suspect.” Put “phone became hot during a video call” in the first column. Put “someone may be recording me” in the second. Do not merge them until evidence supports the connection.
As of 4 November 2026, this is general security information, not a forensic diagnosis. If your only concern is a change in performance, begin with ordinary troubleshooting. If your concern includes threats, coercion, or a credible security alert, choose the more cautious checks below.
What do the orange and green dots actually show?
On supported iPhones running iOS 14 or later, an orange indicator shows microphone use. A green indicator shows camera use, or camera and microphone use together. Apple describes these as indicators of an app using those capabilities. The color is not a verdict that the app is malicious. [2]
Ask what you were doing at that moment. Were you recording a voice message, making a call, taking a photo, or using a feature you deliberately opened? If the activity surprises you, note the time and the app involved. That is a better starting point than taking a photo of a dot with no context.
On supported Android versions, the privacy dashboard shows which apps accessed permissions and when. Open Settings, look under Privacy or Security and Privacy, then find Privacy dashboard. Choose the microphone or camera permission and examine the listed activity. Menu names vary with the device and software version. [3]
Compare the record with your own activity. You are asking a narrow question: “Why did this app use this permission then?” Avoid turning the answer into a broader claim that every conversation was captured or that a particular organization was responsible.
How can I check sharing without making things worse?
Before removing access, consider whether someone may react if they notice the change. The FTC warns that an abusive person using stalkerware may escalate when access is interrupted. If that fits your situation, seek trusted support from another device and make a personal safety plan before changing the suspected phone. [4]
On an iPhone with iOS 16 or later, Safety Check can help review sharing with people and apps and review account security. Manage Sharing & Access allows a selective review; Emergency Reset is intended for quickly stopping sharing. Read the explanations before choosing, rather than selecting the broadest option automatically. [5]
Make a private checklist of the sharing you intended: which person, which information, and for what reason. Work through one item at a time. If a family arrangement or work requirement is unclear, write down the question rather than guessing.
Also examine connections between your Google Account and other developers' apps. You can remove unwanted access, but revoking a connection does not delete information already held by that other service. Treat this as a review of account permissions, separate from a search for malware. [13]
Is location tracking the same as microphone surveillance?
No. EFF explains that mobile operators can determine a phone's location from its connection to the cellular network. This is separate from an app using GPS or microphone permissions. Turning off location permission for an app does not, by itself, stop location tracking through the mobile network. [6]
That distinction matters when choosing a remedy. Revoking a microphone permission addresses that app's microphone access. Reviewing location sharing addresses a different question. Neither action should be described as a universal switch that makes a connected phone untrackable. [6]
Describe your concern as precisely as you can. “Someone knows where I went” is different from “someone repeated words from a private conversation.” Neither statement identifies the source of the information. Write down what was said, when, and why it seemed private; then discuss possible explanations with a trusted helper.
For people in Iran, do not interpret a phone settings screen as a complete assessment of state surveillance. The limits of the particular check matter. Ask a helper to name the kind of access being examined and which kinds remain outside that check.
What does documented spyware targeting tell us?
Targeted mobile surveillance against Iranians is documented. In October 2022, ESET described a FurBall malware variant distributed as an Android translation app through a copycat website. The analyzed sample requested access to contacts; ESET also discussed broader capabilities if permissions were expanded. Do not turn those potential capabilities into a claim that every installed sample recorded everything. [8]
This historical case supports caution about an app's origin. It does not show that the same distribution remains active today or that your phone has that malware. A matching theme, such as “translation app,” is not enough to match a device to a research report. [8]
Use research to ask better questions: Where did I obtain this app? Did its publisher and download route match what I intended? Which permissions did it request? What evidence would a qualified analyst need? Avoid downloading old malware samples or visiting attack links to compare them with your phone.
When someone offers a diagnosis, ask whether it comes from evidence on your device or from a general news story. Keep the research report and your own observations separate. That makes it easier to investigate a genuine concern without presenting speculation as a confirmed finding.
What if Apple sends a threat notification?
Apple describes its threat notifications as high-confidence alerts about individual targeting by mercenary spyware. They warrant attention, but Apple does not claim absolute certainty. Verify an alert independently through your Apple Account, rather than trusting a link or caller claiming to represent support. [9]
Lockdown Mode is an optional protection for people facing sophisticated targeted attacks. Apple says it limits some apps, websites, and features to reduce attack exposure. It is not a scan that tells you whether spyware is present, and most people do not need this level of restriction. [10]
If you are considering it, first read the feature restrictions for your devices. Make a short list of the communications you rely on and discuss practical alternatives with your trusted support person. Turn a broad recommendation into a plan you can actually follow.
Take the notification, the device model, and the date of the alert to a suitable expert. Describe it as a notification about targeting, not as a laboratory finding naming the attacker. Keep the message intact and avoid publishing account details while asking for help.
Can an app or a dial code prove my phone is clean?
Amnesty International's Security Lab says its mobile forensic tools are designed for experts and may not detect the latest advanced spyware without additional knowledge and private indicators. The practical implication is limited: even a sophisticated investigation has boundaries. A negative result should be explained in terms of what was checked, not turned into a lifetime guarantee. [7]
Do not treat a viral dial-code tutorial or a reassuring screenshot as a substitute for evidence. Before relying on any proposed test, ask what it checks. Does it inspect an account setting, an app permission, or traces of a specific attack? If the person recommending it cannot explain that, do not accept its conclusion as a diagnosis.
For a professional examination, ask for a plain-language result: what was examined, what was found, which tools were used, and what could not be ruled out. Ask before sending a complete backup or granting remote access. Decide which private information is necessary for the agreed task.
A useful outcome can be a clear next step even when certainty is unavailable: repair an account setting, remove an unnecessary permission, preserve a suspicious record, or seek a more specialized examination.
How should I document concerns and seek help?
Safety Net recommends recording incidents and keeping evidence somewhere the person causing harm cannot easily access. Choose a record that captures the event and its context: dates, messages, relevant account activity, and the change you noticed. Do not collect evidence in a way that puts you at greater personal risk. [12]
Here is a suggested handover format: “I observed [event] on [date]. The information that concerned me was [detail]. I have checked [specific settings]. I have not changed [items preserved]. My immediate concern is [safety, privacy, or account access].” Keep the first message brief and ask how to share anything sensitive.
Access Now's free Digital Security Helpline supports eligible civil-society users, including journalists, activists, and human rights defenders. It conducts an initial eligibility review. That makes it a relevant independent option for work-related targeting, not a promise of general technical support for every phone concern. [11]
If you ask an ordinary repair technician for help, request a written description of what they checked. Keep “battery replacement recommended” separate from “spyware found.” For related account and device guidance, use Pouyam's online security guides.
| Observation | What it supports | What it does not prove |
|---|---|---|
| Warmth during setup or intensive use | Check the ordinary causes Apple lists. | Secret microphone recording. |
| Orange iPhone indicator | An app is using the microphone. | Who will receive any information. |
| Unexpected microphone activity in Android’s dashboard | Review that app’s permission and the time of use. | That all calls were intercepted. |
| Negative forensic result | Discuss the scope and limits of the examination. | That every possible surveillance method is absent. |
Common mistakes
Naming an attacker from a battery symptom
Fix: Describe the symptom and its timing. Keep any suspected explanation separate from the observation.
Treating a permission as a diagnosis
Fix: Look at the app, the time, and the feature you were using. Permission activity needs context. [3]
Removing access before considering personal safety
Fix: If another person may retaliate, plan the change with trusted support first. [4]
Frequently asked questions
Does a green dot always mean the microphone is on?
No. Apple says green means the camera alone, or the camera and microphone together. Orange indicates microphone use without the camera. [2]
Can I see every past microphone access on Android?
Do not assume an unlimited history. Google describes version-dependent windows in the privacy dashboard, including 24 hours on Android 12 and seven days on Android 13. Check the version-specific help for your device. [3]
Will Lockdown Mode remove spyware that is already present?
Apple describes it as a protective mode that restricts features and reduces attack exposure. Do not treat switching it on as evidence that an existing compromise has been removed. Seek an assessment if you have a credible alert. [10]
What if an expert finds nothing?
Ask what the examination could detect and what remained outside its scope. Amnesty’s guidance explicitly describes limitations in detecting recent advanced spyware. The absence of a finding is not a universal proof of absence. [7]
Glossary
- Spyware
- Software used to obtain information from a device covertly; the type and access determine what it can collect. [4]
- Permission
- An app’s allowed access to a feature or information, such as the microphone. Review it together with actual use. [3]
- Forensic examination
- An investigation of digital evidence. Ask for its findings, methods, and limits rather than a blanket guarantee. [7]
Sources
- If your iPhone or iPad gets too hot or too cold Apple Support · 2026-05-14
- About the orange and green indicators in your iPhone status bar Apple Support · 2026-10-22
- Manage permissions from the privacy dashboard Android Help
- Stalkerware: What To Know Federal Trade Commission
- Safety Check for an iPhone with iOS 16 or later Apple Personal Safety User Guide
- Mobile Phones: Location Tracking Electronic Frontier Foundation
- Tools and Guides Amnesty International Security Lab
- Domestic Kitten campaign spying on Iranian citizens with new FurBall malware ESET Research / WeLiveSecurity · 2022-10-20
- About Apple threat notifications and protecting against mercenary spyware Apple Support · 2026-08-13
- About Lockdown Mode Apple Support · 2026-09-14
- Digital Security Helpline Access Now · 2022-07-29
- Documentation Tips for Survivors of Technology Abuse & Stalking NNEDV Safety Net Project
- Manage links between your Google Account & apps from other developers Google Account Help
Comments
Top comments